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The Turbo Assembler Quick-Reference Guide contains abbreviated 

discussions of the TASM predefined symbols, operators, and directives in 
Parts 1, 2, and 3, and a thorough discussion of the processor and 
coprocessor instructions in Parts 4 and 5. 

Several notational conventions are followed in this manual: 

■ Italics: In text, italics represent labels, placeholders, variables, and ar- 
rays. In syntax expressions, placeholders are set in italics to indicate 
that they are user-defined. 

■ Boldface: Boldface is used in text for directives, instructions, symbols, 
and operators, as well as for command-line options. 

■ CAPITALS: In text, capital letters are used to represent instructions, di- 
rectives, registers, and operators. 

■ Monospace: Monospace type is used to display any sample code, text 
or code that appears on your screen, and any text that you must actu- 
ally type to assemble, link, and run a program. 

■ Keycaps: In text, keycaps are used to indicate a key on your keyboard. It 
is often used when describing a key you must press to perform a par- 
ticular function; for example, "Press Enter after typing your program 
name at the prompt." 
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Predefined symbols 



All the predefined symbols can be used in both MASIVI and Ideal mode. 
_ 

Represents the current location counter within the current segment. 

©code 

AHas equate for .CODE segment name. 

@CodeSize 

Numeric equate that indicates code memory model (0=near, l=far). 
_____ 

Numeric equate that returns information about current processor directive. 

@curseg 

Alias equate for current segment. 

@data 

Alias equate for near data group name. 

@DataSize 

Numeric equate that indicates the data memory model (0=near, l=far, 

2=huge). 

_____ 

String equate for today's date. 

@fardata 

Alias equate for initialized far data segment name. 

@fardata? 

Alias equate for uninitialized far data segment name. 

©FileName 

Alias equate for current assembly file name. 

??filename 

String equate for current assembly file name. 

@Model 

Numeric equate representing the model currently in effect. 
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©startup 



©Startup 

Label that marks the beginning of startup code. 



??time 

String equate for the current time. 



??version 

Numeric equate for current Turbo Assembler version number. 

@WordSize 

Numeric equate that indicates 16- or 32-bit segments (2= 16-bit, 4=32-bit). 
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Operators 



This part covers the operators Turbo Assembler provides and their pre- 
cedence. The two tables that follow detail operator precedence for Ideal 
and MASM modes. 



Ideal mode operator precedence 

The following table lists the operators in order of priority (highest is first, 
lowest is last): 

■ 0, [], LENGTH, MASK, OFFSET, SEG, SIZE, WIDTH 

■ HIGH, LOW 

■ +, - (unary) 

■ *, /, MOD, SHL, SHR 

■ +, - (binary) 

■ EQ, GE, GT, LE, LT, NE 

■ NOT 

■ AND 

■ OR, XOR 

■ : (segment override) 

■ . (structure member selector) 

■ HIGH (before pointer), LARGE, LOW (before pointer), PTR, SHORT, 
SMALL, SYMTYPE 

MASM mode operator precedence 

■ <, 0, [], LENGTH, MASK, SIZE, WIDTH 

■ . (structure member selector) 

■ HIGH, LOW 

■ +, - (unary) 

■ : (segment override) 

■ OFFSET, PTR, SEG, THIS, TYPE 

■ *, /, MOD, SHL, SHR 

■ +, - (binary) 

■ EQ, GE, GT, LE, LT, NE 

■ NOT 

■ AND 

■ OR, XOR 

■ LARGE, SHORT, SMALL, .TYPE 
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Operators 
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() 

(expression) 
Marks expression for priority evaluatior\. 



Ideal, MASM 



Ideal, MASM 



expression! * expression! 

Multiplies two integer expressions. Also used with 80386 addressing 
modes where one expression is a register. 



+ (binary) 

expression! + expression! 
Adds two expressions. 



+ (unary) 

+ expression 
Indicates that expression is positive. 



- (binary) 

expression! - expression! 
Subtracts two expressions. 



- (unary) 

- expression 
Changes the sign of expression. 



memptr. fieldname 
Selects a structure member. 



/ 

expression! / expression! 
Divides two integer expressions. 



Ideal, MASM 



Ideal, MASM 



Ideal, MASM 



Ideal, MASM 



Ideal, MASM 



Ideal, MASM 
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Ideal, MASM 



segorgroup : expression 
Generates segment or group override. 



Ideal, MASM 



Dx? 



Initializes with indeterminate data (where Dx is DB, DD, DF, DP, DQ, 
DT, or DW). 

[ ] Ideal, MASM 

expressionl[expression2] 

[expressionl] [expression!] 

MASM mode: The [ ] operator can be used to specify addition or register 
indirect memory operands. 

Ideal mode: The [ ] operator specifies a memory reference. 

AND ideal, MASM 

expressionl AND expressionl 
Performs a bit-by-bit logical AND of two expressions. 



BYTE 

BYTE expression 
Forces address expression to be byte size. 



Ideal 



BYTE PTR 

BYTE PTR expression 
Forces address expression to be byte size. 



Ideal, MASM 



CODEPTR 

CODEPTR expression 
Returns the default procedure address size. 



DUP 

count DUP {expression [,expression]...) 
Repeats a data allocation operation cow «f times. 



Ideal, MASM 



DATAPTR Ideal 

DATAPTR expression 
Forces address expression to model-dependent size. 



Ideal, MASM 
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DWORD 
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DWORD 

DWORD expression 
Forces address expression to be doubleword size. 



Ideal 



DWORD PTR 

DWORD PTR expression 
Forces address expression to be doubleword size. 



EQ 

expressionl EQ expression! 
Returns true if expressions are equal. 



Ideal, MASM 



Ideal, MASM 



FAR Ideal 

FAR expression 
Forces an address expression to be a far code pointer. 

FAR PTR Ideal, MASM 

FAR PTR expression 
Forces an address expression to be a far code pointer. 

FWORD Ideal 

FWORD expression 

Forces address expression to be 32-bit far pointer size. 

FWORD PTR Ideal, MASM 

FWORD PTR expression 
Forces address expression to be 32-bit far pointer size. 

GE Ideal, MASM 

expressionl GE expressionl 
Returns true if one expression is greater than or equal to the other. 

GT Ideal, MASM 

expressionl GT expression! 
Returns true if one expression is greater than the other. 

HIGH Ideal, MASM 

HIGH expression 
Returns the high part (8 bits or type size) of expression. 
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HIGH 



HIGH Ideal 

type HIGH expression 
Returns the high part (8 bits or type size) of expression. 

LARGE Ideal, MASM 

LARGE expression 

Sets expression's offset size to 32 bits. In Ideal mode, this operation is legal 
only if 386 code generation is enabled. 

LE Ideal, MASM 

expression! LE expression! 
Returns true if one expression is less than or equal to the other. 

LENGTH Ideal, MASM 

LENGTH name 
Returns number of data elements allocated as part of name. 

LOW Ideal, MASM 

LOW expression 
Returns the low part (8 bits or type size) of expression. 

LOW Ideal 

type LOW expression 
Returns the low part (8 bits or type size) of expression. 

LT Ideal, MASM 

expression! LT expression! 
Returns true if one expression is less than the other. 

MASK Ideal, MASM 

MASK recordfieldname 
MASK record 

Returns a bit mask for a record field or an entire record. 

MOD Ideal, MASM 

expression! MOD expression! 
Returns remainder (modulus) from dividing two expressions. 
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NE 

expressionl NE expression! 
Returns true if expressions are not equal. 



NE 



Ideal, MASM 



NEAR Ideal 

NEAR expression 

Forces an address expression to be a near code pointer. 

NEAR PTR Ideal, MASM 

NEAR PTR expression 
Forces an address expression to be a near code pointer. 

NOT Ideal, MASM 

NOT expression 
Performs a bit-by-bit complement (invert) of expression. 

OFFSET Ideal, MASM 

OFFSET expression 

Returns the offset of expression within the current segment (or the group 
that the segment belongs to, if using simplified segmentation directives or 
Ideal mode). 

OR Ideal, MASM 

expressionl OR expression! 
Performs a bit-by-bit logical OR of two expressions. 

PROG Ideal 

PROC expression 
Forces an address expression to be a near or far code pointer. 

PROC PTR Ideal, MASM 

PROC PTR expression 
Forces an address expression to be a near or far code pointer. 

PTR Ideal, MASM 

type PTR expression 
Forces address expression to have type size. 
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PWORD 

PWORD Ideal 

PWORD expression 
Forces address expression to be 32-bit far pointer size. 

PWORD PTR Ideal. MASM 

PWORD PTR expression 
Forces address expression to be 32-bit far pointer size. 



QWORD 

QWORD expression 
Forces address expression to be quadword size. 



Ideal 



QWORD PTR 

QWORD PTR expression 
Forces address expression to be quadword size. 



Ideal, MASM 



SEG Ideal, MASM 

SEG expression 
Returns the segment address of an expression that references memory. 

SHL Ideal, MASM 

expression SHL count 

Shifts the value of expression to the left count bits. A negative count causes 
the data to be shifted the opposite way. 

SHORT Ideal, MASM 

SHORT expression 

Forces expression to be a short code pointer (within -128 to +127 bytes of 
the current code location). 

SHR Ideal, MASM 

expression SHR count 

Shifts the value of expression to the right count bits. A negative count 
causes the data to be shifted the opposite way. 



SIZE 

SIZE name 



Ideal, MASM 



Returns size of data item allocated with name. In MASM mode, SIZE re- 
turns the value of LENGTH name multiplied by TYPE name. In Ideal 
mode, SIZE returns the byte count within name's DUP. 
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SMALL 



SMALL Ideal, MASM 

SMALL expression 
Sets expression's offset size to 16 bits. In Ideal mode, this operation is legal 



only if 386 code generation is enabled. 



SYMTYPE Ideal 

SYMTYPE 
Returns a byte describing expression. 

TBYTE Ideal 

TBYTE expression 
Forces address expression to be 10-byte size. 

TBYTE PTR ideal, masm 

TBYTE PTR expression 
Forces address expression to be 10-byte size. 

THIS Ideal, MASM 

THIS type 

Creates an operand whose address is the current segment and location 
counter, type describes the size of the operand and whether it refers to 
code or data. 

.TYPE MASM 

.TYPE expression 
Returns a byte describing the mode and scope of expression. 

TYPE IDEAL 

TYPE namel name! 

Applies the type of an existing variable or structure member to another 
variable or structure member. 

TYPE MASM 

TYPE expression 
Returns a number indicating the size or type of expression. 

UNKNOWN idi^ 

UNKNOWN expression 
Removes type information from address expression. 
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WIDTH 



Ideal, MASM 



WIDTH recordfieldname 
WIDTH record 



Returns the width in bits of a field in a record, or of an entire record. 

WORD Ideal 

WORD expression 
Forces address expression to be word size. 

WORDPTR Ideal. MASM 

WORD PTR expression 
Forces address expression to be word size. 

XOR Ideal, MASM 

expressionl XOR expression! 

Performs bit-by-bit logical exclusive OR of two expressions. 
Unconditional page break inserted for print formatting 

The special macro operators 



& 

&cname 
Substitutes actual value of macro parameter name. 



Ideal, MASM 



<> 



Ideal, MASM 



Treats text literally, regardless of any special characters it might contain. 



Ideal, MASM 



[character 



Treats character literally, regardless of any special meaning it might other- 
wise have. 



Ideal, MASM 



%text 



Treats text as an expression, computes its value and replaces text with the 
result, text may be either a numeric expression or a text equate. 
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_J 

^3 ;; Ideal, MASM 

- J ;comment 

- ^ Suppresses storage of a comment in a macro definition. 

1 J 

-^ 
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.186 



. 1 86 MASM 

Enables assembly of 80186 processor instructions. 

.286 MASM 

Enables assembly of non-privileged (real mode) 80286 processor instruc- 
tions and 80287 numeric coprocessor instructions. 

.286C MASM 

Enables assembly of non-privileged (real mode) 80286 processor instruc- 
tions and 80287 numeric coprocessor instructions. 

.286P MASM 

Enables assembly of all 80286 (including protected mode) processor in- 
structions and 80287 numeric coprocessor instructions. 

.287 MASM 

Enables assembly of 80287 numeric coprocessor instructions. 

.386 MASM 

Enables assembly of non-privileged (real mode) 386 processor instructions 
and 387 numeric coprocessor instructions. 

.386C MASM 

Enables assembly of non-privileged (real mode) 386 processor instructions 
and 387 numeric coprocessor instructions. 

.386P MASM 

Enables assembly of all 386 (including protected mode) processor instruc- 
tions and 387 numeric coprocessor instructions. 

.387 MASM 

Enables assembly of 387 numeric coprocessor instructions. 

.486 MASM 

Enables assembly of non-privileged (real mode) instructions for the i486 
processor. 

.4860 MASM 

Enables assembly of non-privileged (real mode) instructions for the i486 
processor. 
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.486P 



.-J 
I) 

.J 



.486P MASM 

Enables assembly of protected mode instructions for the 80486 processor. 

.8086 MASM 

Enables assembly of 8086 processor instructions only. This is the default 
^ processor instruction mode used by Turbo Assembler. 

J 

J .8087 MASM 

J Enables assembly of 8087 numeric coprocessor instructions only. This is 

the default coprocessor instruction mode used by Turbo Assembler. 

: Ideal, MASM 

name: 
Defines a near code label called name. 

= Ideal, MASM 

name = expression 
J Defines or redefines a numeric equate. 



ALIGN Ideal, MASM 

ALIGN boundary 

Rounds up the location counter to a power-of-two address boundary (2, 4, 
8, ...). 



) .ALPHA MASM 

J Sets alphanumeric segment-ordering. The /a command-line option per- 

-, forms the same function. 



ARG Ideal, MASM 



ARG argument {argument] ... [=symbol] 
[RETURNS argument [/argument]] 



W-) Sets up arguments on the stack for procedures. Each argument is assigned 

' \ a positive offset from the BP register, presuming that both the return ad- 

t , dress of the procedure call and the caller's BP have been pushed onto the 

-- ^ stack already. Each argument has the following syntax (boldface items are 

:^ ) literal): 

2 J argname [[countl]] [:ldebug_size] [type] [xountZ]] 

O The optional debug_size has this syntax: 

13 [type] PTR 

CJ 
-J 
CJ 
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ASSUME Ideal, MASM 

ASSUME segmentreg-.name [^egmentreg:name\... 
ASSUME segmentreg-.NOTHlNG 
ASSUME NOTHING 

Specifies the segment register {segmentreg) that will be used to calculate 
the effective addresses for all labels and variables defined under a given 
segment or group name (name). The NOTHING keyword cancels the asso- 
ciation between the designated segment register and segment or group 
name. The ASSUME NOTHING statement removes all associations be- 
tween segment registers and segment or group names. 

7oBI ideal, MASM 

%BIN size 
Sets the width of the object code field in the listing file to size columns. 

CATSTR ideal, MASM51 

name CATSTR string [string]... 
Concatenates several strings to form a single string name. 

.CODE MASM 

CODESEG Ideal, MASM 

.CODE [name] 
CODESEG [name] 

Defines the start of a code segment when used with the .MODEL direc- 
tive. If you have specified the medium or large memory model, you can 
follow the .CODE (or CODESEG) directive with an optional name that in- 
dicates the name of the segment. 

COMM ideal, MASM 

COMM definition [,definition]... 

Defines a communal variable. Each definition describes a symbol and has 
the following format (boldface items are literal): 

[distance] [language] symbolname[ [ countl ] ]:type [xountl] 

distance can be either NEAR or FAR and defaults to the size of the default 
data memory model if not specified, language is either C, PASCAL, 
BASIC, FORTRAN, PROLOG, or NOLANGUAGE and defines any lan- 
guage-specific conventions to be applied to symbolname. symbolname is the 
communal symbol (or symbols, separated by commas). If distance is 
NEAR, the linker uses countl to calculate the total size of the array. If dis- 
tance is FAR, the linker uses countl to indicate how many elements there 
are of size countl times the basic element size (determined by type), type 
can be one of the following: BYTE, WORD, DATAPTR, CODEPTR, 
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COMMENT 

C) 

. J DWORD, FWORD, PWORD, QWORD, TBYTE, or a structure name. 

count! specifies how many items this communal symbol defines. Both 
countl and count! default to 1. 

1.) 

_j COMMENT MASM 

■^ COMMENl delimiter [text] 

[text] 
delimiter [text] 

Starts a multiline comment, delimiter is the first non-blank character foUow- 
^ J ing COMMENT. 
1.) 

%COND Ideal, MASM 

Shows all statements in conditional blocks in the listing. This is the de- 
r , fault mode for Turbo Assembler. 

:: .CONST, MASM 

-. J 

^ 3 CONST Ideal. MASM 

^ -'' Defines the start of the constant data segment. 

1) 

L) 
i) 
C) 
Zj 



J 



J 



.CREF MASM 



7oCREF Ideal, MASM 

Allows cross-reference information to be accumulated for all symbols en- 
countered from this point forward in the source file. .CREF reverses the ef- 
fect of any %XCREF or .XCREF directives that inhibited the information 
collection. 

7oCREFALL ideal, MASM 

Causes all subsequent symbols in the source file to appear in the cross- 
reference listing. This is the default mode for Turbo Assembler. 
%CREFALL reverses the effect of any previous %CREFREF or 
%CREFUREF directives that disabled the listing of unreferenced or refer- 
enced symbols. 



3 7oCREFREF ideal, masm 

) Disables listing of unreferenced symbols in cross-reference. 



7oCREFUREF ideal, masm 

Lists only the unreferenced symbols in cross-reference. 

%CTLS Ideal, MASM 

Causes listing control directives (such as % LIST, %INCL, and so on) to be 
placed in the listing file. 
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.DATA MASM 

DATASEG Ideal 

Defines the start of the initialized data segment in your module. You 
must first have used the .MODEL directive to specify a memory model. 
The data segment is put in a group called DGROUP, which also contains 
the segments defined with the .STACK, .CONST, and .DATA? directives. 

.DATA? MASM 

Defines the start of the uninitialized data segment in your module. You 
must first have used the .MODEL directive to specify a memory model. 
The data segment is put in a group called DGROUP, which also contains 
the segments defined with the .STACK, .CONST, and .DATA directives. 

DB Ideal, MASM 

[name] DB expression [,expression]... 

Allocates and initializes a byte of storage, name is the symbol you'll subse- 
quently use to refer to the data, expression can be a constant expression, a 
question mark, a character string, or a DUPlicated expression. 

DD Ideal, MASM 

[name] DD [type PTR] expression [,expression]... 

Allocates and initializes 4 bytes (a doubleword) of storage, name is the 
symbol you'll subsequently use to refer to the data, type followed by PTR 
adds debug information to the symbol being defined, so that Turbo De- 
bugger can display its contents properly, type is one of the following: 
BYTE, WORD, DATAPTR, CODEPTR, DWORD, FWORD, PWORD, 
QWORD, TBYTE, SHORT, NEAR, FAR or a structure name, expression 
can be a constant expression, a 32-bit floating-point number, a question 
mark, an address expression, or a DUPlicated expression. 

7oDEPTH Ideal, MASM 

%DEPTH width 
Sets size of depth field in listing file to width columns. The default is 1 col- 



DF Ideal, MASM 

[name] DF [type PTR] expression [,expression]... 

Allocates and initializes 6 bytes (a far 48-bit pointer) of storage, name is 
the symbol you'll subsequently use to refer to the data, type followed by 
PTR adds debug information to the symbol being defined, so that Turbo 
Debugger can display its contents properly, type is one of the following: 
BYTE, WORD, DATAPTR, CODEPTR, DWORD, FWORD, PWORD, 
QWORD, TBYTE, SHORT, NEAR, FAR or a structure name, expression 
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DISPLAY 



can be a constant expression, a question mark, an address expression, or a 
Duplicated expression. 

DISPLAY Ideal, MASM 

DISPLAY "text" 
Outputs a quoted string (text) to the screen. 

^J DOSSEG ideal, MASM 

-- ^ Enables DOS segment-ordering at link time. Use this directive only when 

^ j you are writing stand-alone assembler programs. Use DOSSEG once in 

' ^ the main module that specifies the starting address of your program. 

DP Ideal, MASM 

- -' [name] DP [type PTR] expression [,expression]... 

Allocates and initializes 6 bytes (a far 48-bit pointer) of storage, name is 
_ ) the symbol you'll subsequently use to refer to the data, type followed by 

PTR adds debug information to the symbol being defined, so that Turbo 
Debugger can display its contents properly, type is one of the following: 
1 J BYTE, WORD, DATAPTR, CODEPTR, DWORD, FWORD, PWORD, 

2 QWORD, TBYTE, SHORT, NEAR, FAR or a structure name, expression 

, . can be a constant expression, a question mark, an address expression, or a 

- ^ Duplicated expression. 

C) 

' J DQ Ideal, MASM 

~ ) [name] DQ expression [expression]... 

'^j Allocates and initializes 8 bytes (a quadword) of storage, name is the sym- 

bol you'll subsequently use to refer to the data, expression can be a con- 
stant expression, a 64-bit floating-point number, a question mark, or a 

^ J Duplicated expression. 



^i 



o 



IJ 



DT Ideal, MASM 

[name] DT expression [,expression]... 

Allocates and initializes 10 bytes of storage, name is the symbol you'll sub- 
sequently use to refer to the data, expression can be a constant expression, 
a packed decimal constant expression, a question mark, an 80-bit floating- 
point number, or a DUPlicated expression. 

DW Ideal, MASM 

[name] DW [type PTR] expression [expression]... 

Allocates and initializes 2 bytes (a word) of storage, name is the symbol 
you'll subsequently use to refer to the data, type followed by PTR adds 
debug information to the symbol being defined, so that Turbo Debugger 
can display its contents properly, type is one of the following: BYTE, 
WORD, DATAPTR, CODEPTR, DWORD, FWORD, PWORD, 
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ELSE 



QWORD, TBYTE, SHORT, NEAR, FAR or a structure name, expression 
can be a constant expression, a question mark, an address expression, or a 
Duplicated expression. 

ELSE Ideal, MASM i^ 

ELSE y 

IF condition ' 

statements! 
[ELSE 

statements!] 
ENDIF r 

Starts alternative conditional assembly block. The statements introduced ' 

by ELSE {statements!) are assembled if condition evaluates to false. 

ELSEIF Ideal, MASM 

ELSEIF 

IF conditionl 

statements! 
[ELSEIF conditionl 

statements!] 
ENDIF 

Starts nested conditional assembly block if condition! is true. Several other 
forms of ELSEIF are supported: ELSEIFl, ELSEIF2, ELSEIFB, 
ELSEIFDEF, ELSEIFDIF, ELSEIFDIFI, ELSEIFE, ELSEIFIDN, 
ELSEIFIDNI, ELSEIFNB, and ELSEIFNDEF. 

EMUL Ideal, MASM 

Causes all subsequent numeric coprocessor instructions to be generated as 
emulated instructions, instead of real instructions. When your program is 
executed, you must have a software floating-point emulation package in- 
stalled or these instructions will not work properly. 

END Ideal, MASM 

END [startaddress] 

Marks the end of a source file, startaddress is a symbol or expression that 
specifies the address in your program where you want execution to begin. 
Turbo Assembler ignores any text that appears after the END directive. 

ENDIF Ideal, MASM 

ENDIF r 
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ENDM 



J IF condition 

statements 

ENDIF 
J 

' Marks the end of a conditional assembly block started with one if the IF- 

-' xxxx directives. 

ENDM Ideal, MASM 

J 

j Marks the end of a repeat block or a macro definition. 



~ ENDP Ideal, MASM 

^ ' ENDP [procname] 

•--^ [procname] ENDP 

Marks the end of a procedure. If procname is supplied, it must match the 
^ 1 procedure name specified with the PROC directive that started the proce- 
dure definition. 

ENDS Ideal, MASM 

- ^ ENDS [segmentname I strucname] 

2,, [segmentname I strucnamejENDS 

Marks end of current segment, structure or union. If you supply the op- 
tional name, it must match the name specified with the corresponding 
SEGMENT, STRUG, or UNION directive. 

o 

ZJ EQU Ideal, MASM 

\ ) name EQU expression 

'> Defines name to be a string, alias, or numeric equate containing the result 

'■ , of evaluating expression. 

-- .ERR MASM 

ERR Ideal, MASM 

Forces an error to occur at the line that this directive is encountered on in 
_ j the source file. 



.ERRl MASM 

Forces an error to occur on pass 1 of assembly. 

.ERR2 MASM 

Forces an error to occur on pass 2 of assembly if multiple-pass mode (con- 
trolled by /m command-line option) is enabled. 

.ERRB MASM 

.ERRB argument 
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.ERRDEF 



Forces an error to occur if argument is blank (empty). 

.ERRDEF MASM 

.ERRDEF symbol 
Forces an error to occur if symbol is defined. 

.ERRDIF MASM 

.ERRDIF argumentl/jrgumentZ 

Forces an error to occur if arguments are different. The comparison is case 
sensitive. 

.ERRDIFI MASM 

.ERRDIFI argumentlflrgumentl 

Forces an error to occur if arguments are different. The comparison is not 
case sensitive. 

.ERRE MASM 

.ERRE expression 
Forces an error to occur if expression is false (0). 

.ERRIDN MASM 

.ERRIDN argumentl argument! 

Forces an error to occur if arguments are identical. The comparison is case 
sensitive. 

.ERRIDNI MASM 

.ERRIDNI argumentl, argument! 

Forces an error to occur if arguments are identical. The comparison is not 
case sensitive. 

ERRIF Ideal, MASM 

ERRIF expression 
Forces an error to occur if expression is true (nonzero). 

ERRIF 1 Ideal, MASM 

Forces an error to occur on pass 1 of assembly. 

ERRIF2 Ideal, MASM 

Forces an error to occur on pass 2 of assembly if multiple-pass mode (con- 
trolled by /m command-line option) is enabled. 
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.,_ J 



ERRIFB Ideal, MASM 

' ERRIFB argument 

Forces an error to occur if argument is blank (empty). 

-:. ERRIFDEF ideal, masm 

J ERRIFDEF symbol 

^ Forces an error if symbol is defined. 

j 

ERRIFDIF Ideal, MASM 

> ERRIFDIF argumentlfirgumentl 

Forces an error to occur if arguments are different. The comparison is case 
sensitive. 

ERRIFDIFI Ideal, MASM 

>' ERRIFDIFI argumentl Argument! 

"' Forces an error to occur if arguments are different. The comparison is not 
case sensitive. 



■_J 



ERRIFE Ideal, MASM 

ERRIFE expression 
Forces an error if expression is false (0). 

J ERRIFIDN Ideal, MASM 

ERRIFIDN argumentl Argument! 

Forces an error to occur if arguments are identical. The comparison is case 
j sensitive. 

ERRIFIDNI Ideal, MASM 

, ERRIFIDNI argumentl, argument! 

Forces an error to occur if arguments are identical. The comparison is not 
case sensitive. 

) ERRIFNB Ideal, MASM 

j ERRIFNB argument 

.) Forces an error to occur if argument is not blank. 



ERRIFNDEF ideal, masm 

ERRIFNDEF symbol 
Forces an error to occur if symbol is not defined. 
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.ERRNB 

.ERRNB MASM 

.ERRNB argument 
Forces an error to occur if argument is not blank. 

r 

.ERRNDEF masm r 

.ERRNDEF symbol '[ ' 

Forces an error to occur if symbol is not defined. ( 

.ERRNZ MASM 

.ERRNZ expression 
Forces an error to occur if expression is true (nonzero). 

EVEN Ideal, MASM 

Rounds up the location counter to the next even address. 

EVEN DATA ideal, MASM 

Rounds up the location counter to the next even address in a data seg- 
ment. 

EXiTM Ideal, MASM 

Terminates macro- or block-repeat expansion and returns control to the 
next statement following the macro or repeat-block call. 

EXTRN Ideal, MASM 

EXTRN definition [definition]... 

Indicates that a symbol is defined in another module, definition describes a 
symbol and has the following format: 

[language] name[countl]:type [xountl] 

language specifies that the naming conventions of C, PASCAL, BASIC, 
FORTRAN, ASSEMBLER, or PROLOG are to be applied to symbol 
name, name is the symbol that is defined in another module and can op- 
tionally be followed by countl, an array element multiplier that defaults to 
1. type must match the type of the symbol where it's defined and must be 
one of the following: NEAR, FAR, PROC, BYTE, WORD, DWORD, 
DATAPTR, CODEPTR, FWORD, PWORD, QWORD, TBYTE, ABS, or a ^ 

structure name, countl specifies how many items this external symbol de- ^ 

fines and defaults to 1 if not specified. '. 
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.FARDATA 



.FARDATA masm 

FARDATA ideal, MASM 

.FARDATA [segmentname] 
FARDATA [segmentname] 

Defines the start of a far initialized data segment, segmentname, if present, 
overrides the default segment name. 

.FARDATA? masm 

.FARDATA? [segmentname] 

Defines the start of a far uninitialized data segment, segmentname, if pres- 
ent, overrides the default segment name. 

GLOBAL Ideal, MASM 

GLOBAL definition [,definition]... 

Acts as a combination of the EXTRN and PUBLIC directives to define a 
global symbol, definition describes the symbol and has the following for- 
mat (boldface items are literal): 

[language] name [[ countl ]] -.type [xountl] 

language specifies that the naming conventions of C, PASCAL, BASIC, 
FORTRAN, NOLANGUAGE, or PROLOG are to be applied to symbol 
name. If name is defined in the current source file, it is made public exactly 
as if used in a PUBLIC directive. If not, it is declared as an external sym- 
bol of type type, as if the EXTRN directive had been used, name can be fol- 
lowed by an optional array count multiplier, countl, which defaults to 1. 
type must match the type of the symbol in the module where it is defined 
and must be one of the following: NEAR, FAR, PROC, BYTE, WORD, 
DATAPTR, CODEPTR, DWORD, FWORD, PWORD, QWORD, 
TBYTE, ABS, or a structure name, count! specifies how many items this 
symbol defines (1 is the default). 

GROUP Ideal, MASM 

GROUP groupname segmentname [segmentname]... 
groupname GROUP segmentname [,segmentname]... 

Associates groupname with one or more segments, so that all labels and 
variables defined in those segments have their offsets computed relative 
to the beginning of group groupname. segmentname can be either a segment 
name defined previously with SEGMENT or an expression starting with 
SEG. In MASM mode, you must use a group override whenever you ac- 
cess a symbol in a segment that is part of a group. In Ideal mode. Turbo 
Assembler automatically generates group overrides for such symbols. 



-.J 
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IDEAL 



IDEAL Ideal, MASM 

Enters Ideal assembly mode. Ideal mode will stay in effect until it is over- 
ridden by a MASM or QUIRKS directive. 

IF Ideal, MASM 

IF 

IF expression 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that expression is true (nonzero). 

IF1 Ideal, MASM 

IFl 

IFl 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that the current assembly pass is 
pass one. 

IF2 Ideal, MASM 

IF2 

IFl 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that multiple-pass mode (controlled 
by the /m command-line option) is enabled and the current assembly pass 
is pass two. 

IFB Ideal, MASM 

IFB 
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IFDEF 



- -' IFB argument 

truestatements 
^ \ [ELSE 

falsestatements] 
ENDIF 

TT7 Initiates a conditional block, causing the assembly of truestatements up to 

■ ^ the optional ELSE directive, provided that argument is blank (empty). 

IFDEF Ideal, MASM 

^ IFDEF 

7 IFDEF sym&o/ 

truestatements 
I [ELSE 

Z falsestatements] 

ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
1 " the optional ELSE directive, provided that symbol is defined. 

I 

r IFDiF Ideal, MASM 

- IFDIF 

- . IFDTF argumentl Argument! 

truestatements 
C) [ELSE 

' I falsestatements] 

T:', ENDIF 

^' Initiates a conditional block, causing the assembly of truestatements up to 

the optional ELSE directive, provided that the arguments are different. 
■2 J The comparison is case sensitive. 

T IFDIFI Ideal, MASM 

r IFDIFI 

IFDIFI argumentl, argument! 
truestatements 
: : [ELSE 

- I falsestatements] 
': " ENDIF 

~ ^ Initiates a conditional block, causing the assembly of truestatements up to 

^-^ the optional ELSE directive, provided that the arguments are different. 

r ) The comparison is not case sensitive. 



'LJ 



IFE Ideal, MASM 

IFE 
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IFIDN 



IFE expression 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that expression is false. 

IFIDN Ideal, MASM 

IFIDN 

IFIDN argumentl/irgumentl 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that the arguments are identical. 
The comparison is case sensitive. 

IFIDNI Ideal, MASM 

IFIDNI 

IFIDNI argumentl argument! 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that the arguments are identical. 
The comparison is not case sensitive. 

IFNB ideal, MASM 

IFNB 

IFNB argument 

truestatements 
ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that argument is nonblank. 

IFNDEF Ideal, MASM 

IFNDEF 
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7olNCL 



J 



-^ 7olNCL 



IFNDEF symbol 

truestatements 
[ELSE 

falsestatements] 
ENDIF 

Initiates a conditional block, causing the assembly of truestatements up to 
the optional ELSE directive, provided that symbol is not defined. 

Ideal, MASM 

Enables listing of include files. This is the default INCLUDE file listing 
mode. 

INCLUDE MASM, Ideal 

INCLUDE filename or INCLUDE "filename" 

Includes source code from file filename at the current position in the mod- 
ule being assembled. If no extension is specified, .ASM is assumed. 

INCLUDEUB MASM, ideal 

INCLVDEUB filename or INCLUDELIB "filename" 

Causes the linker to include library filename at link time. If no extension is 

specified, .LIB is assumed. 

INSTR Ideal, MASM51 

name INSTR [start, ]stringl, string! 

name is assigned the position of the first instance of string! in stringl. 
Searching begins at position start (position one if start not specified). If 
string! does not appear anywhere within stringl, name is set to zero. 

IRP Ideal, MASM 

IRP parameter fir gl[,arg2\... 

statements 
ENDM 

Repeats a block of statements with string substitution, statements are as- 
sembled once for each argument present. The arguments may be any text, 
such as symbols, strings, numbers, and so on. Each time the block is as- 
sembled, the next argument in the list is substituted for any instance of pa- 
' rameter in the statements. 

J 

IRPC Ideal, MASM 

, IRPC parameter, string 

statements 
' ENDM 

' Repeats a block of statements with character substitution, statements are as- 

) sembled once for each character in string. Each time the block is as- 
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JUMPS 



sembled, the next character in the string is substituted for any instances of 
parameter in statements. 

JUMPS Ideal, MASM 

Causes Turbo Assembler to look at the destination address of a condi- 
tional jump instruction, and if it is too far away to reach with the short 
displacement that these instructions use, it generates a conditional jump 
of the opposite sense around an ordinary jump instruction to the desired 
target address. This directive has the same effect as using the /JJUMPS 
command-line option. 

LABEL MASM, Ideal 

name LABEL type 
LABEL name type 

Defines a symbol name to be of type type, name must not have been de- 
fined previously in the source file, type must be one of the following: 
NEAR, FAR, PROC, BYTE, WORD, DATAPTR, CODEPTR, DWORD, 
FWORD, PWORD, QWORD, TBYTE, or a structure name. 

.LALL MASM 

Enables listing of macro expansions. 

.LFCOND MASM 

Shows all statements in conditional blocks in the listing. 

%LINUM Ideal, MASM 

%LINUM size 

Sets the width of the line-number field in listing file to size columns. The 
default is four columns. 

7oLIST Ideal, MASM 

.LIST MASM 

Shows source lines in the listing. This is the default listing mode. 

LOCAL Ideal, MASM 

In macros: 

LOCAL symbol [,symbol]... 

In procedures: 

LOCAL element [,element]... [=symbol] 

Defines local variables for macros and procedures. Within a macro defini- 
tion, LOCAL defines temporary symbol names that are replaced by new 



34 PART 3, Directives 



LOCALS 



^ ) unique symbol names each time the macro is expanded. LOCAL must ap- 

j pear before any other statements in the macro definition. 

, Within a procedure, LOCAL defines names that access stack locations as 

^ ' negative offsets relative to the BP register. If you end the argument list 

— ^ with an equal sign (=) and a symbol, that symbol will be equated to the 

-—, total size of the local symbol block in bytes. Each element has the follow- 
ing syntax (boldface brackets are literal): 






symname [[countl]] [:[debug_size] [:type] [:count2]] 

type is the data type of the argument. It can be one of the following: 
BYTE, WORD, DATAPTR, CODEPTR, DWORD, FWORD, PWORD, 
QWORD, TBYTE, NEAR, FAR, PROC, or a structure name. If you don't 
specify a type, WORD size is assumed. 

countl specifies how many items of type the symbol defines. The default 
for countl is 1 if it is not specified. 

countl is an array element size multiplier. The total space allocated for the 
symbol is countl times the length specified by the type field times countl. 
The default for countl is 1 if it is not specified. 

The optional debug_size has this syntax: 

[type] PTR 

LOCALS Ideal, MASM 

LOCALS [prefix] 

Enables local symbols, whose names will begin with two at-signs (@@) or 
the two-character prefix if it is specified. Local symbols are automatically 
enabled in Ideal mode. 

MACRO Ideal, MASM 

MACRO name [parameter [,parameter]...] 
name MACRO [parameter [,parameter]...] 

Defines a macro to be expanded later when name is encountered, parame- 
ter is a placeholder that you use in the the body of the macro definition 
wherever you want to substitute one of the actual arguments the macro is 
called with. 

%MACS Ideal, MASM 

Enables listing of macro expansions. 

MASM Ideal, MASM 

Enters MASM assembly mode. This is the default assembly mode for 
Turbo Assembler. 

MASM51 Ideal, MASM 

Enables assembly of some MASM 5.1 enhancements. 
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MODEL Ideal, MASM 

.MODEL MASM 

MODEL [model modifier] memorymodel [module name] 

[,[language modifier] language ] [,model modifier] 
.MODEL [model modifier] memorymodel [module name] 

[^language modifier] language] [,model modifier] 

Sets the memory model for simplified segmentation directives, model modi- 
fier can come before memorymodel or at the end of the statement and must 
be either NEARSTACK or FARSTACK if present, memorymodel is TINY, 
SMALL, MEDIUM, COMPACT, LARGE, HUGE or TCHUGE. module 
name is used in the large models to declare the name of the code seg- 
ment, language modifier is WINDOWS, ODDNEAR, ODDFAR, or NOR- 
MAL and specifies generation of MSWindows procedure entry and exit 
code, language specifies which language you will be calling from to access 
the procedures in this module: C, PASCAL, BASIC, FORTRAN, PRO- 
LOG, or NOLANGUAGE. Turbo Assembler automatically generates the 
appropriate procedure entry and exit code when you use the PROC and 
ENDP directives, language also tells Turbo Assembler which naming con- 
ventions to use for public and external symbols, and in what order proce- 
dure arguments were pushed onto the stack by the calling module. Also, 
the appropriate form of the RET instruction is generated to remove the ar- 
guments from the stack before returning if required. 

MULTERRS ideal, MASM 

Allows multiple errors to be reported on a single source line. 

NAME Ideal, MASM 

NAME modulename 

Sets the object file's module name. This directive has no effect in MASM 
mode; it only works in Ideal mode. 

7oNEWPAGE Ideal, MASM 

Starts a new page in the listing file. 

7oNOCONDS Ideal, MASM 

Disables the placement of statements in conditional blocks in the listing 
file. 

7oNOCREF Ideal, MASM 

%NOCREF [symbol, ... ] 

Disables cross-reference listing (CREF) information accumulation. If you 
supply one or more symbol names, cross-referencing is disabled only for 
those symbols. 
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7oNOCTLS 



7oNOCTLS Ideal, MASM 

Disables placement of listing-control directives in the listing file. This is 
the default listing-control mode for Turbo Assembler. 

NOEMUL Ideal, MASM 

Causes all subsequent numeric coprocessor instructions to be generated as 
real instructions, instead of emulated instructions. When your program is 
executed, you must have an 80x87 coprocessor installed or these instruc- 
tions will not work properly. This is the default floating-point assembly 
mode for Turbo Assembler. 

7oNOiNCL Ideal, MASM 

Disables listing of source lines from INCLUDE files. 

NOJUMPS Ideal, MASM 

Disables stretching of conditional jumps enabled with JUMPS. This is the 
default mode for Turbo Assembler. 

7oNOLIST Ideal, MASM 

Disables output to the listing file. 

NOLOCALS Ideal, MASM 

Disables local symbols enabled with LOCALS. This is the default for 
Turbo Assembler's MASM mode. 

%NOMACS Ideal, MASM 

Lists only macro expansions that generate code. This is the default macro 
listing mode for Turbo Assembler. 

NOMASM51 Ideal, MASM 

Disables assembly of certain MASM 5.1 enhancements enabled with 
MASM51. This is the default mode for Turbo Assembler. 

NOMULTERRS ideal, masm 

Allows only a single error to be reported on a source line. This is the de- 
fault error-reporting mode for Turbo Assembler. 

NOSMART Ideal, MASM 

Disables code optimizations that generate different code than MASM. 

%NOSYMS Ideal, MASM 

Disables placement of the symbol table in the listing file. 
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%NOTRUNC 



7oNOTRUNC Ideal, MASM 

Prevents truncation of fields whose contents are longer than the corre- 
sponding field widths in the listing file. 
60 points 

NO WARN ideal, MASM 

NOWARN [warnclass] 

Disables warning messages with warning identifier warnclass, or all warn- 
ing messages if warnclass is not specified. 

ORG Ideal, MASM 

ORG expression 

Sets the location counter in the current segment to the address specified 
by expression. 

7oOUT MASM 

%OUT text 
Displays text on screen. 

PI 86 Ideal, MASM 

Enables assembly of 80186 processor instructions. 

P286 Ideal, MASM 

Enables assembly of all 80286 (including protected mode) processor in- 
structions and 80287 numeric coprocessor instructions. 

P286N Ideal, MASM 

Enables assembly of non-privileged (real mode) 80286 processor instruc- 
tions and 80287 numeric coprocessor instructions. 

P286P Ideal, MASM 

Enables assembly of all 80286 (including protected mode) processor in- 
structions and 80287 numeric coprocessor instructions. 

P287 Ideal, MASM 

Enables assembly of 80287 numeric coprocessor instructions. 

P386 Ideal, MASM 

Enables assembly of all 386 (including protected mode) processor instruc- 
tions and 387 numeric coprocessor instructions. 
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P386N Ideal, MASM 

Enables assembly of non-privileged (real mode) 386 processor instructions 
and 387 numeric coprocessor instructions. 

P386P Ideal, MASM 

Enables assembly of all 386 (including protected mode) processor instruc- 
tions and 387 numeric coprocessor instructions. 

P387 Ideal, MASM 

Enables assembly of 387 numeric coprocessor instructions. 

P486 Ideal, MASM 

Enables assembly of all i486 (including protected mode) processor instruc- 
tions. 

P486N Ideal, MASM 

Enables assembly of non-privileged (real mode) i486 processor instruc- 
tions. 

P8086 Ideal, MASM 

Enables assembly of 8086 processor instructions only. This is the default 
processor instruction mode for Turbo Assembler. 

P8087 Ideal, MASM 

Enables assembly of 8087 numeric coprocessor instructions only. This is 
the default coprocessor instruction mode for Turbo Assembler. 
PAGE, MASM 

7oPAGESIZE Ideal, MASM 

PAGE [rows] [,cols] 
%PAGESIZE [rows] [,cols] 

Sets the listing page height and width, starts new pages, rows specifies the 
number of lines that will appear on each listing page (10..255). cols speci- 
) fies the number of columns wide the page will be (59.. 255). Omitting rows 

or cols leaves the current setting unchanged. If you follow PAGE with a 
plus sign (+), a new page starts, the section number is incremented, and 
the page number restarts at 1. PAGE with no arguments forces the listing 
to resume on a new page, with no change in section number. 



7oPCNT ideal, MASM 

%PCNT width 

Sets segmentroffset field width in listing file to width columns. The default 
is 4 for 16-bit segments and 8 for 32-bit segments. 
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PN087 Ideal, MASM 

Prevents the assembling of numeric coprocessor instructions (real or emu- 
lated). 

7oPOPLCTL Ideal, MASM 

Resets the listing controls to the way they were when the last 
%PUSHLCTL directive was issued. 

PROC Ideal, MASM 

PROC [language modifier] [language] name [distance] 

[USES items,] [argument [/irgument]...] 

[RETURNS argument [/irgument]...] 
name FROC [language modifier] [language] [distance] 

[USES items,] [argument [/irgument]...] 

[RETURNS argument [/irgument]...] 

Defines the start of procedure name, language modifier is either WINDOWS 
or NOWINDOWS, to specify generation of MSWindows entry/exit code. 
language specifies which language you will be calling from to access this 
procedure: C, PASCAL, BASIC, FORTRAN, NOLANGUAGE, or PRO- 
LOG. This determines symbol naming conventions, the order of any argu- 
ments on the stack, and whether the arguments will be left on the stack 
when the procedure returns, distance is NEAR or FAR and determines the 
type of RET instruction that will be assembled at the end of the proce- 
dure, items is a list of registers and/or single-token data items to be 
pushed on entry and popped on exit from the procedure, argument de- 
scribes an argument the procedure is called with. Each argument has the 
following syntax: 

argname[[countl]] [[distance] [PTR] type] [xountl] 

argname is the name you'll use to refer to this argument throughout the 
procedure, distance is NEAR or FAR to indicate that the argument is a 
pointer of the indicated size, type is the data type of the argument and can 
be BYTE, WORD, DWORD, FWORD, PWORD, QWORD, TBYTE, or a 
structure name. WORD is assumed if none is specified, countl and count! 
are the number of elements of type. PTR tells Turbo Assembler to emit 
debug information to let Turbo Debugger know that the argument is a 
pointer to a data item. Using PTR without distance causes the pointer size 
to be based on the current memory model and segment address size. RE- 
TURNS introduces one or more arguments that won't be popped from 
the stack when the procedure returns. 

PUBLIC Ideal, MASM 

PUBLIC [language] symbol [,[language] symbol]... 

Declares symbol to be accessible from other modules. If language is speci- 
fied (C, PASCAL, BASIC, FORTRAN, ASSEMBLER, or PROLOG), sym- 
bol is made public after having the naming conventions of the specified 
language applied to it. 
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PUBLICDLL Ideal, MASM 

PUBLICDLL [language] symbol [,[language] symbol]... 

Declares symbols to be accessible as dynamic link entry points from other 
modules, symbol (a PROC or program label, data variable name, or nu- 
meric constant defined with EQU) becomes accessible to other programs 
under OS/2. If language is specified (C, PASCAL, BASIC, FORTRAN, 
PROLOG, or NOLANGUAGE), symbol is made public after having the 
naming conventions of the specified language applied to it. 

PURGE Ideal, MASM 

PURGE macroname [,macroname]... 
Removes macro definition macroname. 

7oPUSHLCTL Ideal, MASM 

Saves current listing controls on a 16-level stack. 

QUIRKS Ideal, MASM 

Allows you to assemble a source file that makes use of one of the true 
MASM bugs. 

.RADIX MASM 

RADIX Ideal, MASM 

.RADIX radix 
RADIX radix 

Sets the default radix for integer constants in expressions to 2, 8, 10, or 16. 

RECORD MASM, Ideal 

name RECORD field [field]... 
RECORD name field [field]... 

Defines record name that contains bit fields. Each field describes a group of 
bits in the record and has the following format (boldface items are literal): 

fieldname.width[=expression] 

fieldname is the name of a field in the record, width (1..16) specifies the 
number of bits in the field. If the total number of bits in all fields is 8 or 
less, the record will occupy 1 byte; 9.. 16 bits will occupy 2 bytes; other- 
wise, it will occupy 4 bytes, expression provides a default value for the 
field. 
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REPT Ideal, MASM 

REPT expression 

statements 
ENDM 

Repeats a block of statements expression times. 

RETCODE ideal, MASM 

Generates either a near return (2-byte displacement) or a far return (4-byte 
displacement) depending on the size of the memory model declared in 
the .MODULE directive. A tiny, small, or compact memory model results 
in a near return, while a medium, large, or huge memory model results in 
a far return. See the RET processor instruction in Chapter 4 for more infor- 
mation. 

RETF Ideal, MASM 

Generates a far return (4-byte displacement) from a procedure. See the 
RET processor instruction in Chapter 4 for more information. 

RETN Ideal, MASM 

Generates a near return (2-byte displacement) from a procedure. See the 
RET processor instruction in Chapter 4 for more information. 

.SALL MASM 

Suppresses the listing of all statements in macro expansions. 

SEGMENT MASM, ideal 

SEGMENT name [align] [combine] [use] ['class'] 
name SEGMENT [align] [combine] [use] ['class'] 

Defines segment name with full attribute control. If you have already de- 
fined a segment with the same name, this segment is treated as a continu- 
ation of the previous one. align specifies the type of memory boundary 
where the segment must start: BYTE, WORD, DWORD, PARA (default), 
or PAGE, combine specifies how segments from different modules but 
with the same name will be combined at link time: AT expression (locates 
segment at absolute paragraph address expression), COMMON (locates 
this segment and all other segments with the same name at the same ad- 
dress), MEMORY (concatenates all segments with the same name to form 
a single contiguous segment), PRIVATE (does not combine this segment 
with any other segments; this is the default used if none specified), PUB- 
LIC (same as MEMORY above), STACK (concatenates all segments with 
the same name to form a single contiguous segment, then initializes SS to 
the beginning of the segment and SP to the length of the segment) or VIR- 
TUAL (defines a special kind of segment that will be treated as a common 
area and attached to another segment at link time), use specifies the de- 
fault word size for the segment if 386 code generation is enabled, and can 
be either USE16 or USE32. class controls the ordering of segments at link 
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time: segments with the same class name are loaded into memory to- 
gether, regardless of the order in which they appear in the source file. 

.SEQ MASM 



Sets sequential segment-ordering. This is the default ordering mode for 
Turbo Assembler. .SEQ has the same function as the Is command-line op- 
j tion. 



.SFCOND MASM 

Prevents statements in false conditional blocks from appearing in the list- 
ing file. 



SIZESTR Ideal, MASM51 

name SIZESTR string 

Z) Assigns the number of characters in string to name. A null string has a 

- \ length of zero. 

—^ SMART Ideal, MASM 



Enables all code optimizations. 



.STACK MASM 



- ^ STACK Ideal, MASM 

13 



.STACK [size] 
STACK [size] 

Defines the start of the stack segment, allocating size bytes. 1024 bytes are 
allocated if size is not specified. 

) 

STRUC MASM, Ideal 

) name STRUC 

fields 

[name] ENDS 
; STRUC name 

fields 
ENDS [name] 

Defines a structure called name containing fields. Each field uses the nor- 
mal data allocation directives (DB, DW, and so on) to define its size, fields 
may be named or remain nameless. Field names must be unique when 
using MASM mode but don't need to be when using Ideal mode. 
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SUBSTR Ideal, MASM51 

name SUBSTR string, position[Mze] 

Defines a new string name consisting of characters from string starting at 
position, with a length of size. All the remaining characters in string, start- 
ing from position, are assigned to name if size is not specified. 

SUBTTL MASM 



%SUBTTL 

SUBTTL text 
%SUBTTL "text" 

Sets subtitle in listing file to text. 



Ideal, MASM 



7oSYMS 



Ideal, MASM 



Enables symbol table placement in listing file. This is the default symbol 
listing mode for Turbo Assembler. 



7oTABSIZE 

%TABSIZE width 



Ideal, MASM 



Sets the number of columns between tabs in the listing file to width. The 
default is 8 columns. 

7oTEXT Ideal, MASM 

%TEXT width 
Sets width of source field in listing file to width columns. 

.TFCOND MASM 

Toggles conditional block-listing mode. 

TITLE MASM 



7oTITLE 

TITLE text 
%TITLE "text" 

Sets title in listing file to text. 



Ideal, MASM 



7oTRUNC 

Truncates listing fields that are too long. 



ideal, MASM 



UDATASEG 

Defines the start of an uninitialized data segment. 



Ideal, MASM 
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UFARDATA 



UFARDATA ideal, MASM 

Defines the start of an uninitialized far data segment. 

UNION Ideal, MASM (disabled by QUIRKS) 



UNION name 

: , fields 

!"^ ENDS [name] 

-^ name UNION 

I J fields 

- '. [name] ENDS 

Defines a union called name. A union is just like a STRUC except that all 
~"^ its members have an offset of zero from the start of the union. This results 

- y in a set of fields that are overlayed, allowing you to refer to the memory 

area defined by the union with different names and different data sizes. 
7-'. The length of a union is the length of its largest member, not the sum of 

^ -' the lengths of its members as in a STRUC. fields define the fields that com- 

'^j prise the union. Each field uses the normal data allocation directives (DB, 

- . DW, and so on) to define its size. 

-^ USES Ideal, MASM 

^^ USES item [,item]... 

^ ^ Indicates which registers or single-token data items you want to have 

C3 pushed at the beginning of the enclosing procedure and which ones you 

- N want popped just before the procedure returns. You must use this direc- 
"■_' tive before the first instruction that actually generates code in your proce- 
wJ dure. 

Cj 

WARN Ideal, MASM 

WARN [warnclass] 

Enables the type of warning message specified with warnclass, or all warn- 
ings if warnclass is not specified, warnclass may be one of: ALN, ASS, 

- ^ BRK, ICG, LCO, OPI, OPP, OPS, OVF, PDC, PRO, PQK, RES, or TPI. 

2 j 

- , .XALL MASM 

- J Causes only macro expansions that generate code or data to be listed. 

^' .XCREF MASM 

^' Disables cross-reference listing (CREF) information accumulation. 

Z ) .XLIST MASM 

_ ? Disables subsequent output to listing file. 
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Processor Instructions 



This part presents instructions for the x86 in alphabetical order. For each 
instruction, the forms are given for each operand combination, including 
object code produced, operands required, execution time, and a descrip- 
tion. For each instruction, there is an operational description and a sum- 
mary of exceptions generated. 

Operand-size and address-size attributes 

When executing an instruction, the x86 can address memory using either 
16- or 32-bit addresses. Consequently, each instruction that uses memory 
addresses has associated with it an address-size attribute of either 16 or 32 
bits. Sixteen-bit addresses imply both the use of a 16-bit displacement in 
the instruction and the generation of a 16-bit address offset (segment rela- 
tive address) as the result of the effective address calculation. Thirty-two- 
bit addresses imply the use of a 32-bit displacement and the generation of 
a 32-bit address offset. Similarly, an instruction that accesses words (16 
bits) or doublewords (32 bits) has an operand-size attribute of either 16 or 
32 bits. 

The attributes are determined by a combination of defaults, instruction 
prefixes, and (for programs executing in protected mode) size-specifica- 
tion bits in segment descriptors. 

Default segment attribute 

For programs executed in protected mode, the D-bit in executable-seg- 
ment descriptors determines the default attribute for both address size 
and operand size. These default attributes apply to the execution of all 
instructions in the segment. A value of zero in the D-bit sets the default 
address size and operand size to 16 bits; a value of one, to 32 bits. 

Programs that execute in real mode or virtual-8086 mode have 16-bit ad- 
dresses and operands by default. 

Operand-size and address-size Instruction prefixes 

The internal encoding of an instruction can include two byte-long pre- 
fixes: the address-size prefix, 67H, and the operand-size prefix, 66H. (A 
later section, "Instruction format," shows the position of the prefixes in an 
instruction's encoding.) These prefixes override the default segment attri- 
butes for the instruction that follows. Table 4.1 shows the effect of each 
possible combination of defaults and overrides. 
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.) 
J 

.3 

J 

, Segment default D= ... 

-^ Operand-size prefix 66h 

J Address-size prefix 67h 

Effective operand size 
. J Effective address size 

j Y = Yes, this instruction prefix is present. 

N = No, this instruction prefix is notpresenl 



Table 4. 1 Effective size attributes 















1 


1 


1 


1 


N 


N 


Y 


Y 


N 


N 


Y 


Y 


N 


Y 


N 


Y 


N 


Y 


N 


Y 


16 


16 


32 


32 


32 


32 


16 


16 


16 


32 


16 


32 


32 


16 


32 


16 



Address-size attribute for stack 



> Instructions that use the stack impUcitly (for example, POP EAX) also 

have a stack address-size attribute of either 16 or 32 bits. Instructions with 
J a stack address-size attribute of 16 use the 16-bit SP stack pointer register; 

) instructions with a stack address-size attribute of 32 bits use the 32-bit eSP 

' register to form the address of the top of the stack. 



The stack address-size attribute is controlled by the B-bit of the data-seg- 
ment descriptor in the SS register. A value of zero in the B-bit selects a 
stack address-size attribute of 16; a value of one selects a stack address- 
size attribute of 32. 



Instruction format 



- ^^ All instruction encodings are subsets of the general instruction format 

^ shown in Figure 4.1. Instructions consist of optional instruction prefixes, 

w) one or two primary opcode bytes, possibly an address specifier consisting 

- ') of the ModR/M byte and the SIB (scale index base) byte, a displacement, 

if required, and an immediate data field, if required. 



Smaller encoding fields can be defined within the primary opcode or op- 
codes. These fields define the direction of the operation, the size of the dis- 

—' placements, the register encoding, or sign extension; encoding fields vary 

'^j depending on the class of operation. 

Most instructions that can refer to a operand in memory have an ad-dress- 
_j ing form byte following the primary opcode byte(s). This byte, called the 

ModR/M byte, specifies the address form to be used. Certain encodings 
^^ of the ModR/M byte indicate a second addressing byte, the SIB byte, 

-3 which follows the ModR/M byte and is required to fully specify the ad- 

^ J dressing form. 

13 
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Figure 4.1 
386 instruction format 



Instruction 
prefix 


Address- 
size prefix 


Operand- 
size prefix 


Segment 
override 


or 1 or 1 or 1 


or 1 


Number ot bytes 




Opcode 


Modr/M 


SIB 


Displacement 


Immediate 


1 or 2 or 1 or 1 0, 1, 2, or 4 


0, 1, 2, or 4 


Number of bytes 



Addressing forms can include a displacement immediately following 
either the ModR/M or SIB byte. If a displacement is present, it can be 8, 
16, or 32 bits. 

If the instruction specifies an immediate operand, the immediate operand 
always follows any displacement bytes. The immediate operand, if speci- 
fied, is always the last field of the instruction. 

■ The following are the allowable instruction prefix codes: 

■ F3h: REP prefix (used only with string instructions) 

■ F3h: REPE/REPZ prefix (used only with string instructions) 

■ F2h: REPNE/REPNZ prefix (used only with string instructions) 

■ FOh: LOCK prefix 

The following are the segment override prefixes: 

H 2Eh: CS segment override prefix 
H 36h: SS segment override prefix 

■ 3Eh: DS segment override prefix 

■ 26h: ES segment override prefix 

■ 64h: FS segment override prefix (386 only) 

■ 65h: GS segment override prefix (386 only) 

■ 66h: Operand-size override 

■ 67h: Address-size operand 
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ModR/M and SIB bytes 



The ModR/M and SIB bytes follow the opcode byte(s) in many of the x86 
instructions. They contain the following information: the indexing type or 
register number to be used in the instruction; the register to be used, or 
more information to select the instruction; and the base, index, and scale 
information. 

The ModR/M byte contains three fields of information: 

■ The mod field, which occupies the two most significant bits of the byte, 
combines with the r/m field to form 32 possible values: 8 registers and 
24 indexing modes. 

■ The reg field, which occupies the next three bits following the mod 
field, specifies either a register number or three more bits of opcode 
information. The meaning of the reg field is determined by the first (op- 
code) byte of the instruction. 

■ The r/m field, which occupies the three least-significant bits of the byte, 
can specify a register as the location of an operand, or can form part of 
the addressing-mode encoding in combination with the mod field as de- 
scribed earlier. 

■ The based indexed and scaled indexed forms of 32-bit addressing re- 
quire the SIB byte. The presence of the SIB byte is indicated by certain 
encodings of the ModR/M byte. The SIB byte then includes the follow- 
ing fields: 

■ The ss field, which occupies the 2 most-significant bits of the byte, speci- 
fies the scale factor. 

■ The index field, which occupies the next 3 bits following the ss field 
specifies the register number of the index register. 

■ The base field, which occupies the 3 least-significant bits of the byte, 
specifies the register number of the base register. 

Figure 4.2 shows the format of the ModR/M and SIB bytes. 
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Figure 4.2 
ModR/M and SIB byte formats 



Modr/M Byte 



7 6 


5 4 3 
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Mod 


Reg/Opcode 


R/M 


SIB (Scale Index Base) Byte 
7 6 5 4 3 2 10 


SS 


Index 


Base 



The values and corresponding addressing forms of the ModR/M and SIB 
bytes are shown in Tables 4.2, 4.3, and 4.4. 
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Table 4.2 


16-bit addressing forms with ModR/M byte 




] 


r8(/r) 


AL 


CL 


DL 


BL 


AH 


CH 


DH 


BH 








r16(/r) 


AX 


CX 


DX 


BX 


SP 


BP 


SI 


Dl 






■' 


r32(/r) 


EAX 


ECX 


EDX 


EBX 


ESP 


EBP 


ESI 


EDI 






J 


/digit (opcode) 





1 


2 


3 


4 


5 


6 


7 






J 


REG = 


000 


001 


010 


Oil 


100 


101 


110 


111 






j 


Effective address 


ModR/M 


ModR/M values 


in hexadecimal 






) 


[BX + SI] 




000 


00 


08 


10 


18 


20 


28 


30 


38 




[BX + Dl] 




001 


01 


09 


11 


19 


21 


29 


31 


39 




[BP + SI] 




010 


02 


OA 


12 


1A 


22 


2A 


32 


3A 


] 


[BP + Dl] 


GO 


oil 


03 


OB 


13 


IB 


23 


2B 


33 


3B 


\ 


[SI] 




100 


04 


OC 


14 


1C 


24 


2C 


34 


3C 


' 


[Dl] 




101 


05 


OD 


15 


ID 


25 


2D 


35 


3D 


> 


disp16 




110 


06 


OE 


16 


IE 


26 


2E 


36 


3E 




[BX] 




111 


07 


OF 


17 


IF 


27 


2F 


37 


3F 


"' 


[BX + SI] + disp8 




000 


40 


48 


50 


58 


60 


68 


70 


78 


J 


[BX + Dl] + disp8 




001 


41 


49 


51 


59 


61 


69 


71 


79 




[BP + SI] + dispS 




010 


42 


4A 


52 


5A 


62 


6A 


72 


7A 


J 


[BP + Dl] + dispB 


01 


oil 


43 


4B 


53 


5B 


63 


6B 


73 


7B 


) 


[SI] + disp8 




100 


44 


4C 


54 


5C 


64 


6C 


74 


7C 




[Dl] + dispB 




101 


45 


4D 


55 


5D 


65 


6D 


75 


7D 


_.! 


[BP] + dispS 




110 


46 


4E 


56 


5E 


66 


6E 


76 


7E 




[BX] + dispS 




111 


47 


4F 


57 


5F 


67 


6F 


77 


7F 


' 


[BX + SI] + disp16 




000 


80 


88 


90 


98 


AO 


A8 


BO 


B8 


J 


[BX + DI] + disp16 




001 


81 


89 


91 


99 


A1 


A9 


B1 


B9 


■, 


[BP + SI] + disp16 




010 


82 


8A 


92 


9A 


A2 


AA 


B2 


BA 


-* 


[BP + DI] + disp16 


10 


oil 


83 


8B 


93 


9B 


A3 


AB 


B3 


BB 


_) 


[Sl] + disp16 




100 


84 


8C 


94 


9C 


A4 


AC 


B4 


BC 




[Dl] + disp16 




101 


85 


8D 


95 


9D 


A5 


AD 


B5 


BD 


--' 


[BP] + disp16 




110 


86 


8E 


96 


9E 


A6 


AE 


B6 


BE 


J 


[BX] + disp16 




111 


87 


8F 


97 


9F 


A7 


AF 


B7 


BF 




EAX/AX/AL (386) 




000 


CO 


C8 


DO 


D8 


EO 


E8 


FO 


F8 


_v 


ECX/CX/CL (386) 




001 


CI 


C9 


Dl 


D9 


El 


E9 


F1 


F9 • 




EDX/DX/DL (386) 




010 


C2 


CA 


D2 


DA 


E2 


EA 


F2 


FA 


-^ 


EBX/BX/BL (386) 


11 


oil 


C3 


CB 


D3 


DB 


E3 


EB 


F3 


FB 


' 


ESP/SP/AH (386) 




100 


C4 


CC 


D4 


DC 


E4 


EC 


F4 


FC 




EBP/BP/CH (386) 




101 


C5 


CD 


D5 


DD 


E5 


ED 


F5 


FD 


J 


ESI/SI/DH (386) 




110 


C6 


CE 


D6 


DE 


E6 


EE 


F6 


FE 


1 


EDI/DI/BH (386) 




111 


C7 


CF 


D7 


DF 


E7 


EF 


F7 


FF 



disp8 denotes an 8-bit displacement following the ModR/f«1 byte, to be sign-extended and added to the index. dispIS 
denotes a 16-bit displacement following the ModR/M byte, to be added to the index. Default segment register is SS 
for the effective addresses containing a BP index, DS for other effective addresses. 



u 
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Table 4.3 


32-bit addressing forms with ModR/M byte (386 




only) 




















r8(/r) 


AL 


CL 


DL 


BL 


AH 


CH 


DH 


BH 






r16(/r) 


AX 


CX 


DX 


BX 


SP 


BP 


SI 


Dl 






r32(/r) 


EAX 


ECX 


EDX 


EBX 


ESP 


EBP 


ESI 


EDI 






/digit(opcode) 





1 


2 


3 


4 


5 


6 


7 






REG = 


000 


001 


010 


Oil 


100 


101 


110 


111 






Effective address ModR/M 


ModR/M values 


in liexadecimal 






[EAX] 




000 


00 


08 


10 


18 


20 


28 


30 


38 


[ECX] 




001 


01 


09 


11 


19 


21 


29 


31 


39 


[EDX] 




010 


02 


OA 


12 


1A 


22 


2A 


32 


3A 


[EBX] 


00 


oil 


03 


OB 


13 


IB 


23 


2B 


33 


3B 


[--][--] 




100 


04 


OC 


14 


1C 


24 


2C 


34 


3C 


disp32 




101 


05 


OD 


15 


ID 


25 


2D 


35 


3D 


[ESI] 




110 


06 


OE 


16 


IE 


26 


2E 


36 


3E 


[EDI] 




111 


07 


OF 


17 


IF 


27 


2F 


37 


3F 


disp8[EAX] 




000 


40 


48 


50 


58 


60 


68 


70 


78 


disp8[ECX] 




001 


41 


49 


51 


59 


61 


69 


71 


79 


disp8[EDX] 




010 


42 


4A 


52 


5A 


62 


6A 


72 


7A 


disp8[EPX]; 


01 


011 


43 


4B 


53 


5B 


63 


6B 


73 


7B 


disp8[- -][--] 




100 


44 


4C 


54 


5C 


64 


6C 


74 


7C 


disp8[EBP] 




101 


45 


4D 


55 


5D 


65 


6D 


75 


7D 


disp8[ESl] 




110 


46 


4E 


56 


5E 


66 


6E 


76 


7E 


disp8[EDI] 




111 


47 


4F 


57 


5F 


67 


6F 


77 


7F 


disp32[EAX] 




000 


80 


88 


90 


98 


AO 


A8 


BO 


B8 


disp32[ECX] 




001 


81 


89 


91 


99 


A1 


A9 


B1 


B9 


disp32[EDX] 




010 


82 


8A 


92 


9A 


A2 


AA 


B2 


BA 


disp32[EBX] 


10 


oil 


83 


8B 


93 


9B 


A3 


AB 


B3 


BB 


disp32[- -][--] 




100 


84 


8C 


94 


9C 


A4 


AC 


B4 


BC 


disp32[EBP] 




101 


85 


8D 


95 


9D 


A5 


AD 


B5 


BD 


disp32[ESI] 




110 


86 


8E 


96 


9E 


A6 


AE 


B6 


BE 


disp32[EDI] 




111 


87 


8F 


97 


9F 


A7 


AF 


B7 


BF 


EAX/AX/AL 




000 


CO 


C8 


DO 


D8 


EO 


E8 


FO 


F8 


ECX/CX/CL 




001 


C1 


C9 


D1 


D9 


El 


E9 


F1 


F9 


EDX/DX/DL 




010 


C2 


CA 


D2 


DA 


E2 


EA 


F2 


FA 


EBX/BX/BL 


11 


011 


C3 


CB 


D3 


DB 


E3 


EB 


F3 


FB 


ESP/SP/AH 




100 


C4 


CC 


D4 


DC 


E4 


EC 


F4 


FC 


EBP/BP/CH 




101 


C5 


CD 


D5 


DD 


E5 


ED 


F5 


FD 


ESI/SI/DH 




110 


C6 


CE 


D6 


DE 


E6 


EE 


F6 


FE 


EDI/DI/BH 




111 


C7 


CF 


D7 


DF 


E7 


EF 


F7 


FF 



[- -] [- -] means a SIB follows the ModR/M byte. d/spS denotes an 8-bit displacement following the SIB byte, to be 
sign-extended and added to the index. d/sp32 denotes a 32-bit displacement following the ModR/M byte, to be 
added to the index. 
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Table 4.4 


32-bit addressing forms with SIB byte (386 only) 


r32 


EAX 


ECX 


EDX 


EBX 


ESP 


[*] 


ESI 


EDI 






Base = 





1 


2 


3 


4 


5 


6 


7 






Base = 


000 


001 


010 


Oil 


100 


101 


110 


111 






Scaled index 


SS index 


!\/IodR/l\/l values 


in hexadecimal 






[EAX] 




000 


00 


01 


02 


03 


04 


05 


06 


07 


[ECX] 




001 


08 


09 


OA 


OB 


OC 


OD 


OE 


OF 


[EDX] 




010 


10 


11 


12 


13 


14 


15 


16 


17 


[EBX] 


00 


oil 


18 


19 


1A 


IB 


1C 


ID 


IE 


IF 


none 




100 


20 


21 


22 


23 


24 


25 


26 


27 


[EBP] 




101 


28 


29 


2A 


2B 


2C 


2D 


2E 


2F 


[ESI] 




110 


30 


31 


32 


33 


34 


35 


36 


37 


[EDI] 




111 


38 


39 


3A 


3B 


3C 


3D 


3E 


3F 


[EAX*2] 




000 


40 


41 


42 


44 


44 


45 


46 


47 


[ECX*2] 




001 


48 


49 


4A 


4B 


4C 


4D 


4E 


4F 


[ECX*2] 




010 


50 


51 


52 


55 


54 


55 


56 


57 


[EBX*2] 


01 


oil 


58 


59 


5A 


5B 


5C 


5D 


5E 


5F 


none 




100 


60 


61 


62 


63 


64 


65 


66 


67 


[EBP*2] 




101 


68 


69 


6A 


6B 


6C 


6D 


6E 


6F 


[ESI*2] 




110 


70 


71 


72 


73 


74 


75 


76 


77 


[EDr2] 




111 


78 


79 


7A 


7B 


7C 


7D 


7E 


7F 


[EAXM] 




000 


80 


81 


82 


83 


84 


85 


86 


87 


[ECXM] 




001 


88 


89 


8A 


8B 


8C 


8D 


8E 


8F 


[EDXM] 




010 


90 


91 


92 


93 


94 


95 


96 


97 


[EBXM] 


10 


oil 


98 


89 


9A 


9B 


9C 


9D 


9E 


9F 


none 




100 


AO 


A1 


A2 


A3 


A4 


A5 


A6 


A7 


[EBP*4] 




101 


A8 


A9 


AA 


AB 


AC 


AD 


AE 


AF 


[ESIM] 




110 


BO 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


[EDIM] 




111 


B8 


B9 


BA 


BB 


BC 


BD 


BE 


BF 


[EAX*8] 




000 


CO 


CI 


C2 


C3 


C4 


C5 


C6 


C7 


[ECX*8] 




001 


C8 


C9 


CA 


CB 


CC 


CD 


CE 


CF 


[EDX*8] 




010 


DO 


D1 


D2 


D3 


D4 


D5 


D6 


D7 


[EBX*8] 


11 


011 


D8 


D9 


DA 


DB 


DC 


DD 


DE 


DP 


none 




100 


EO 


E1 


E2 


E3 


E4 


E5 


E6 


E7 


[EBP*8] 




101 


E8 


E9 


EA 


EB 


EC 


ED 


EE 


EF 


[ESr8] 




110 


FO 


F1 


F2 


F3 


F4 


F5 


F6 


F7 


[EDr81 




111 


F8 


F9 


FA 


FB 


FC 


FD 


FE 


FF 



:'j 



[*] means a disp32 with no base if MOD is GO; othenNise, [ESP]. 
Tiiis provides the following addressing modes: 

disp32[index] (MOD=00) 

disp8[EBP][index] (MOD=01) 

disp32[EBP][index] ([^OD=10) 
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How to read the instruction set pages 

Here's a sample of the format of this chapter: 



Instruction Wliat tine instruction name means 
name Wtnat processor tine instruction works on 

ODITSZAPC 
Flag information goes here 

Opcode Instruction Clocks 

386 286 86 

This table contains clock information 



Flags 



Each entry in this section includes information on which flags in the x86's 
flag register are changed and how. Each flag has a one-letter tag for its 
name. 



= Overflow flag 
D = Direction flag 

1 = Interrupt flag 
T = Trap flag 

S = Sign flag 



Z = Zero flag 
A = Auxiliary flag 
P = Parity flag 
C = Carry flag 



The following symbols indicate how the flag register has changed: 

? = Undefined after the operation 

* = Changed to reflect the results of the instruction 

= Always cleared 

1 = Always set 
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: ^ Opcode 

) The "Opcode" column gives the complete object code produced for each 

form of the instruction. When possible, the codes are given as hexadeci- 
^ -' mal bytes, in the same order in which they appear in memory. Definitions 

^j of entries other than hexadecimal bytes are as follows: 

: ' /digit 

^ J (digit is between and 7.) Indicates that the ModR/M byte of the instruc- 
tion uses only the rim (register or memory) operand. The reg field con- 
tains the digit that provides an extension to the instruction's opcode. 

Indicates that the ModR/M byte of the instruction contains both a register 
operand and an r\m operand. 

- , cb, cw, cd, cp 

^ ' A 1-byte (cb), 2-byte (cw), 4-byte (cd), or 6-byte (cp) value following the 

opcode that is used to specify a code offset and possibly a new value for 
^ ; the code segment register. 

- ^ ib, iw, id 

2 J' A 1-byte (ib), 2-byte (iw), or 4-byte (id) immediate operand to the instruc- 
tion that follows the opcode, ModR/M bytes, or scale-indexing bytes. The 
opcode determines if the operand is a signed value. All words and 

^j doublewords are given with the low-order byte first. 

r +rb, +rw, +rd 

^- ' A register code, from through 7, added to the hexadecimal byte given at 

2 j the left of the plus sign to form a single opcode byte. The codes are 

— ' rb rw rd(386) 



-.J 



AL = 


AX = 


EAX = 


CL = 1 


CX = 1 


ECX = 1 


DL = 2 


DX = 2 


EDX = 2 


BL = 3 


BX = 3 


EBX = 3 


AH = 4 


SP = 4 


ESP = 4 


AH = 4 


SP = 4 


ESP = 4 


CH = 5 


BP = 5 


EBP = 5 


DH = 6 


SI = 6 


ESI = 6 


BH = 7 


DI = 7 


EDI = 7 


Instruction 







The "Instruction" column gives the syntax of the instruction statement as 
it would appear in a TASM 386 program. The following is a list of the 
symbols used to represent operands in the instruction statements: 
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rel8 

A relative address in the rar\ge from 128 bytes before the end of the in- 
struction to 127 bytes after the end of the instruction. 

rell6, rel32 

A relative address within the same code segment as the instruction as- 
sembled. rell6 applies to instructions with an operand-size attribute of 16 
bits; rel32 applies to instructions with an operand-size attribute of 32 bits 
(386 only). 

ptrl6:16, ptrl6:32 

A far pointer, typically in a code segment different from that of the 
instruction. The notation 16:16 indicates that the value of the pointer has 
two parts. The value to the right of the colon is a 16-bit selector or value 
destined for the code segment register. The value to the left corresponds 
to the offset within the destination segment. ptrl6:16 is used when the in- 
struction's operand-size attribute is 16 bits; ptrl6:32 is used with the 32-bit 
attribute (386 only). 

r8 

One of the byte registers AL, CL, DL, BL, AH, CH, DH, or BH. 

rl6 

One of the word registers AX, CX, DX, BX, SP, BP, SI, or DI. 

r32 (386) 

One of the doubleword registers EAX, ECX, EDX, EBX, ESP, EBP, ESI, or 

EDI. 

imm8 

An immediate byte value. immS is a signed number between -128 and 
+127 inclusive. For instructions in which immS is combined with a word 
or doubleword operand, the immediate value is sign-extended to form a 
word or doubleword. The upper byte of the word is filled with the top- 
most bit of the immediate value. 

imml6 

An immediate word value used for instructions whose operand-size attri- 
bute is 16 bits. This is a number between -32,768 and +32,767 inclusive. 

imm32 (386) 

An immediate doubleword value used for instructions whose operand- 
size attribute is 32 bits. It allows the use of a number between 
+2,147,483,647 and -2,147,483,648. 

r/m8 

A 1-byte operand that is either the contents of a byte register (AL, BL, CL, 

DL, AH, BH, CH, DH), or a byte from memory. 

r/ml6 

A word register or memory operand used for instructions whose operand- 
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) size attribute is 16 bits. The word registers are AX, BX, CX, DX, SP, BP, SI, 

, DI. The contents of memory are found at the address provided by the ef- 

fective address computation. 



J 



r/m32 

A doubleword register or memory operand used for instructions whose 
operand-size attribute is 32 bits. The doubleword registers are EAX, EBX, 
^ } ECX, EDX, ESP, EBP, ESI, EDI. The contents of memory are found at the 
address provided by the effective address computation. 

1 ) m8 

• J A memory byte addressed by DS:SI or ES:DI (used only by string instruc- 
tions on the 386). 

; ; mi6 

A memory word addressed by DS:SI or ES:DI (used only by string instruc- 
tions). 

^ ■ m32 

~ ^ A memory doubleword addressed by DS:SI or ES:DI (used only by string 

- > instructions). 

: ml6:16, ml6:32 (386) 

A memory operand containing a far pointer composed of two numbers. 
^ } The number to the left of the colon corresponds to the pointer's segment 
. ^ selector. The number to the right corresponds to its offset. 

ZJ ml6 & 32, ml6 & 16 (186/286/386), m32 & 32 (386) 

- , A memory operand consisting of data item pairs whose sizes are indi- 

r' cated on the left and the right side of the ampersand. All memory address- 

— ^ ing modes are allowed. ml6 & 16 and m32 & 32 operands are used by the 

, B(3UND instruction to provide an operand containing an upper and 

r lower bounds for array indices. ml6 & 32 is used by LIDT and LGDT to 

provide a word with which to load the limit field, and a doubleword with 

J J which to load the base field of the corresponding Global and Interrupt De- 

- ^ scriptor Table Registers. 

__ moffsS, moffsl6, moffs32 (memory offset; 386 only) 

A simple memory variable of type BYTE, WORD, or DWORD (386) used 
^' " by some variants of the MOV instruction. The actual address is given by a 

simple offset relative to the segment base. No ModR/M byte is used in 
J the instruction. The number shown with moffs indicates its size, which is 
^' determined by the address-size attribute of the instruction. 

C) Sreg 

- >, A segment register. The segment register bit assignments are ES = 0, 
-^ CS = 1, SS = 2, DS = 3, FS = 4 (386), and GS = 5 (386). 
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Clocks 

The "Clocks" column gives the number of clock cycles the instruction 
takes to execute. The clock count calculations make the following assump- 
tions: 

■ The instruction has been prefetched and decoded and is ready for execu- 
tion. 

■ Bus cycles do not require wait states. 

■ There are no local bus HOLD requests delaying processor access to the 
bus. 

■ No exceptions are detected during instruction execution. 

■ Memory operands are aligned. 

Clock counts for instructions that have an r/m (register or memory) oper- 
and are separated by a slash. The count to the left is used for a register op- 
erand; the count to the right is used for a memory operand. 

The following symbols are used in the clock count specifications: 

■ n, which represents a number of repetitions. 

■ m, which represents the number of components in the next instruction 
executed, where the entire displacement (if any) counts as one compo- 
nent, the entire immediate data (if any) counts as one component, and 
every other byte of the instruction and prefix(es) each counts as one 
component. 

■ pm=, a clock count that applies when the instruction executes in pro- 
tected mode. pm= is not given when the clock counts are the same for 
protected and real address modes. 

When an exception occurs during the execution of an instruction and the 
exception handler is in another task, the instruction exception time is in- 
creased by the number of clocks to effect a task switch. This parameter de- 
pends on several factors: 

B The type of TSS used to represent the current task (386 TSS or 286 TSS). 

■ The type of TSS used to represent the new task. 

■ Whether the current task is in V86 mode. 

■ Whether the new task is in V86 mode. 

Note: Users should read Intel's documentation for more information 
about protected mode and task switching. 
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AAA ASCII adjust after addition 



Opcode 


Instruction 




Clocks 




Description 


37 


AAA 


486 
3 


386 286 
4 3 


86 
8 


ASCII adjust after addition 



Execute AAA only following an ADD instruction that leaves a byte result 
in the AL register. The lower nibbles of the operands of the ADD instruc- 
tion should be in the range through 9 (BCD digits). In this case, AAA ad- 
justs AL to contain the correct decimal digit result. If the addition pro- 
duced a decimal carry, the AH register is incremented, and the carry and 
auxiliary carry flags are set to 1. If there was no decimal carry, the carry 
and auxiliary flags are set to and AH is unchanged. In either case, AL is 
left with its top nibble set to 0. To convert AL to an ASCII result, follow 
the AAA instruction with OR AL, 30H. 



AAD ASCII adjust before division 



Opcode Instruction 


Clocks 




Description 


486 
D5 0A AAD 14 


386 286 
19 14 


86 
60 


ASCII adjust before division 



AAD is used to prepare two unpacked BCD digits (the least-significant 
digit in AL, the most-significant digit in AH) for a division operation that 
will yield an unpacked result. This is accomplished by setting AL to AL 
+ (10 * AH), and then setting AH to 0. AX is then equal to the binary 
equivalent of the original unpacked two-digit number. 



AAM ASCII adjust AX after multiply 



J Opcode Instruction Clocks Description 



) 486 386 286 86 

D4 0A AAM 15 17 16 83 ASCII adjust AX after multiply 

I Execute AAM only after executing a MUL instruction between two un- 

, packed BCD digits that leaves the result in the AX register. Because the 

^ result is less than 100, it is contained entirely in the AL register. AAM un- 

J packs the AL result by dividing AL by 10, leaving the quotient (most- 

I significant digit) in AH and the remainder (least-significant digit) in AL. 
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AAS 



ASCII adjust AL after subtraction 



Opcode 


Instruction 




Clocks 




Description 


3F 


AAS 


486 
3 


386 286 
4 3 


86 
8 


ASCII adjust AL after subtraction 



Execute AAS only after a SUB instruction that leaves the byte result in the 
AL register. The lower nibbles of the operands of the SUB instruction 
must have been in the range through 9 (BCD digits). In this case, AAS 
adjusts AL so it contains the correct decimal digit result. If the subtraction 
produced a decimal carry, the AH register is decremented, and the carry 
and auxiliary carry flags are set to 1. If no decimal carry occurred, the 
carry and auxiliary carry flags are set to 0, and AH is unchanged. In 
either case, AL is left with its top nibble set to 0. To convert AL to an 
ASCII result, follow the AAS with OR AL, 30H. 



ADC 



Opcode Instruction 



Add with carry 



Clocks 



Description 







486 


386 


286 


86 


10 /r 


ADC r/m8,r8 


1/3 


2/7 


2/7 


3/16+EA 


11 /r 


ADCr/m16,r16 


1/3 


2/7 


2/7 


3/16+EA 


11 /r 


ADC r/m32,r32 


1/3 


2/7 






12 /r 


ADC r8,r/m8 


1/2 


2/6 


2/7 


3/9+EA 


13 /r 


ADC r16,r/m16 


1/2 


2/6 


2/7 


3/9+EA 


13 /r 


ADC r32,r/m32 


1/2 


2/6 






14 ib 


ADC AL,imm8 


1 


2 


3 


4 


15 iw 


ADCAX,imm16 


1 


2 


3 


4 


15 id 


ADC EAX,imm32 


1 


2 






80 /2 ib 


ADC r/m8,imm8 


1/3 


2/7 


3/7 


4/17+EA 


81 /2 iw 


ADCr/m16,imm16 


1/3 


2/7 


3/7 


4/17+EA 


81 /2 id 


ADC r/m32,imm32 


1/3 


2/7 






83 /2 ib 


ADCr/m16,imm8 


1/3 


2/7 


3/7 


4/17+EA 


83 12 ib 


ADC r/m32,imm8 


1/3 


2/7 







Add with carry byte register to r/m byte 

Add with carry word register to r/m word 

Add with CF dword register to r/m word 

Add with carry r/m byte to byte register 

Add with carry r/m word to word register 

Add with CF r/m dword to dword register 

Add with carry immediate byte to AL 

Add with carry immediate word to AX 

Add with carry immediate dword to EAX 

Add with carry immediate byte to r/m byte 

Add with carry immediate word to r/m 

word 

Add with CF immediate dword to r/m 

dword 

Add with CF sign-extended immediate 

byte to r/m word 

Add with CF sign-extended immediate 

byte into r/m dword 



ADC performs an integer addition of the two operands DEST and SRC 
and the carry flag, CF. The result of the addition is assigned to the first op- 
erand (DEST), and the flags are set accordingly. ADC is usually executed 
as part of a multi-byte or multi-word addition operation. When an imme- 
diate byte value is added to a word or doubleword operand, the immedi- 
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ate value is first sign-extended to the size of the word or doubleword op- 
erand. 



ADD 



Add 



Opcode Instruction 



Clocks 



Description 



^J 







486 


386 


286 


86 




04 ib 


ADD AL,imm8 


1 


2 


3 


4 


Add immediate byte to AL 


05 iw 


ADDAX,imm16 


1 


2 


3 


4 


Add immediate word to AX 


05 id 


ADD EAX,imm32 


1 


2 






Add immediate dword to EAX 


80 /O ib 


ADD r/m8,imm8 


1/3 


2/7 


3/7 


4/17+EA 


Add immediate byte to r/m byte 


81 /O iw 


ADDr/m16,imm16 


1/3 


2/7 


3/7 


4/17+EA 


Add immediate word to r/m word 


81 /O id 


ADD r/m32,imm32 


1/3 


2/7 






Add immediate dword to r/m dword 


83 /O ib 


ADDr/m16,imm8 


1/3 


2/7 


3/7 


4/17+EA 


Add sign-extended immediate byte 
to r/m word 


83 /O ib 


ADD r/m32,imm8 


1/3 


2/7 






Add sign-extended immediate byte 
to r/m dword 


00 /r 


ADD r/m8,r8 


1/3 


2/7 


2/7 


3/16+EA 


Add byte register to r/m byte 


01 /r 


ADDr/m16,r16 


1/3 


2/7 


2/7 


3/16+EA 


Add word register to r/m word 


01 /r 


ADD r/m32,r32 


1/3 


2/7 






Add dword register to r/m dword 


02 /r 


ADD r8,r/m8 


1/2 


2/6 


2/7 


3/9+EA 


Add r/m byte to byte register 


03 /r 


ADDr16,r/m16 


1/2 


2/6 


2/7 


3/9+EA 


Add r/m word to word register 


03 /r 


ADD r32,r/m32 


1/2 


2/6 






Add r/m dword to dword register 



ADD performs an integer addition of the two operands (DEST and SRC). 
The result of the addition is assigned to the first operand (DEST), and the 
flags are set accordingly. 

When an immediate byte is added to a word or doubleword operand, the 
immediate value is sign-extended to the size of the word or doubleword 
operand. 



I 


AND 


Logical AND 










D I T 


S 


Z 


A P C 


1 







* 


* 


? * 


_') 


Opcode 


Instruction Clocks 






Description 


) 




486 386 


286 


86 






20 /r 


AND r/m8,r8 1/3 2/7 


2/7 


3/16+EA 


AND byte register into r/m byte 


J 


21 /r 


ANDr/m16,r16 1/3 2/7 


2/7 


3/16+EA 


AND word register into r/m word 


"l 


21 /r 


AND r/m32,r32 1/3 2/7 






AND dword register to r/m dword 




22 /r 


AND r8,r/m8 1/2 2/6 


2/7 


3/9+EA 


AND r/m byte to byte register 


1 


23 /r 


ANDr16,r/m16 1/2 2/6 


2/7 


3/9+EA 


AND r/m word to word register 


J 


23 /r 


AND r32,r/m32 1/2 2/6 






AND r/m dword to dword register 




24 ib 


AND AL,imm8 1 2 


3 


4 


AND immediate byte to AL 


) 


25 iw 


ANDAX,imm16 1 2 


3 


4 


AND immediate word to AX 




25 id 


AND EAX,imm32 1 2 






AND immediate dword to EAX 
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Opcode 


Instruction 




Clocks 






Description 


80 /4 ib 

81 M iw 


AND r/m8,imm8 
ANDr/m16,imm16 


486 
1/3 
1/3 


386 
2/7 
2/7 


286 

3/7 
3/7 


86 

4/17+EA 

4/17+EA 


AND immediate byte to r/m byte 
AND immediate word to r/m word 


81 /4 id 


AND r/m32,imm32 


1/3 


2/7 






AND immediate dword to r/m word 


83 /4 ib 


AND r/m16,imm8 


1/3 


2/7 






AND sign-extended immediate byte 
with r/m word 


83 /4 ib 


AND r/m32,imm8 


1/3 


2/7 






AND sign-extended immediate byte 
with r/m dword 



Each bit of the result of the AND instruction is a 1 if both corresponding 
bits of the operands are 1; otherwise, it becomes a 0. 



ARPL 



Adjust RPL field of selector 
80286/386/1486 protected mode only 



Opcode Instruction 


Clocks 


Description 


486 
63 /r ARPL r/m16,r16 9/9 


386 286 
pm=20/21 pm=10/11 


Adjust RPL of //ml 6 to not less than RPL of r16 



The ARPL instruction has two operands. The first operand is a 16-bit 
memory variable or word register that contains the value of a selector. 
The second operand is a word register. If the RPL field ("requested privi- 
lege level" —bottom two bits) of the first operand is less than the RPL field 
of the second operand, the zero flag is set to 1 and the RPL field of the 
first operand is increased to match the second operand. Otherwise, the 
zero flag is set to and no change is made to the first operand. 

ARPL appears in operating system software, not in application programs. 
It is used to guarantee that a selector parameter to a subroutine does not 
request more privilege than the caller is allowed. The second operand of 
ARPL is normally a register that contains the CS selector value of the 
caller. 



BOUND 



Check array index against bounds 
80186/286/386/486 only 



Opcode Instruction 



Clocks 



Description 





486 


386 


286 




62 /r 


BOUND r1 6, 7 7 


10 


13 


Check if r16 is within m16&16 bounds (passes test) 


62 /r 


BOUNDr32, 7 7 


10 




Check if r32 is within m32&32 bounds (passes test) 



BOUND ensures that a signed array index is within the limits specified by 
a block of memory consisting of an upper and a lower bound. Each 
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bound uses one word for an operand-size attribute of 16 bits and a 
doubleword for an operand-size attribute of 32 bits. The first operand (a 
register) must be greater than or equal to the first bound in memory 
(lower bound), and less than or equal to the second bound in memory 
(upper bound). If the register is not within bounds, an Interrupt 5 occurs; 
the return EIP points to the BOUND instruction. 

The bounds limit data structure is usually placed just before the array it- 
self, making the limits addressable via a constant offset from the begin- 
ning of the array. 



BSF 



Bit scan forward 
386 and i486 only 



Opcode Instruction 



Clocks 



Description 







486 


386 




OFBC 


BSFr16,r/m16 


6-42/7-43 


10-h3n 


Bit scan forward on r/m word 


OFBC 


BSF r32,r/m32 




10+3n 


Bit scan toro/ard on r/m dword 



BSF scans the bits in the second word or doubleword operand starting 
with bit 0. The ZF flag is cleared if the bits are all 0; otherwise, the ZF flag 
is set and the destination register is loaded with the bit index of the first 
set bit. 



BSR 



Bit scan reverse 
386 and i486 oniy 



Opcode Instruction 



Clocks 



Description 







486 


386 




OFBD 


BSRr16,r/m16 


6-103/7-104 


10+3n 


Bit scan reverse on r/m word 


OFBD 


BSR r32,r/m32 


6-103/7-104 


10+3n 


Bit scan reverse on r/m dword 



BSR scans the bits in the second word or doubleword operand from the 
most significant bit to the least significant bit. The ZF flag is cleared if the 
bits are all 0; otherwise, ZF is set and the destination register is loaded 
with the bit index of the first set bit found when scanning in the reverse 
direction. 
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BSWAP 



Byte Swap 
i486 only 



Opcode Instruction Clock Description 



486 
0FC8/r BSWAP r32 1 



Swap bytes to convert little/big endian data in a 32-bit register to big/little 
endian form. 



BSWAP reverses the byte order of a 32-bit register, converting a value in 
little/big endian form to big/little endian form. When BSWAP is used 
with a 16-bit operand size, the result left in the destination register is un- 
defined. 



BT 



Bit test 

386 and i486 only 



opcode 



Instruction 



Clocks 



Description 







486 


386 




OF A3 


BTr/m16,r16 


3/8 


3/12 


Save bit in carry flag 


OF A3 


BT r/m32,r32 


3/8 


3/12 


Save bit in carry flag 


OFBAMib 


BTr/m16,imm8 


3/3 


3/6 


Save bit in carry flag 


OFBAMib 


BT r/m32,imm8 


3/3 


3/6 


Save bit in carry flag 



BT saves the value of the bit indicated by the base (first operand) and the 
bit offset (second operand) into the carry flag. 



ETC 



Bit test and compiement 
386 and i486 only 



Opcode 



Instruction 



Clocks 



Description 







486 


386 


OFBB 


BTC r/m16,r16 


6/13 


6/13 


OFBB 


BTC r/m32,r32 


6/13 


6/13 


0FBA/7ib 


BTCr/m16,imm8 


6/8 


6/8 


0FBA/7ib 


BTC r/m32,imm8 


6/8 


6/8 



Save bit in carry flag and complement 
Save bit in carry flag and complement 
Save bit in carry flag and complement 
Save bit in carry flag and complement 



BTC saves the value of the bit indicated by the base (first operand) and 
the bit offset (second operand) into the carry flag and then complements 
the bit. 
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BTR Bit test and reset 

386 and i486 only 



Opcode Instruction Clocks Description 



-' 486 386 

ji 0FB3 BTRr/m16,r16 6/13 6/13 Save bit in carry flag and reset 

0FB3 BTRr/m32,r32 6/13 6/13 Save bit in carry flag and reset 

-J 0FBA/6ib BTRr/m16,imm8 6/8 6/8 Save bit in carry flag and reset 

0FBA/6ib BTR r/m32,imm8 6/8 6/8 Save bit in carry flag and reset 

.J BTR saves the value of the bit indicated by the base (first operand) and 

■ J the bit offset (second operand) into the carry flag and then stores in the 

: bit. 



BTS Bit test and set 

386 and i486 only 



Opcode Instruction Clocks Description 



-' 486 386 

■j OFAB BTSr/m16,r16 6/13 6/13 Save bit in carry flag and set 

;' OFAB BTSr/m32,r32 6/13 6/13 Save bit in carry flag and set 

.-) 0FBA/5ib BTS r/m16,imm8 6/8 6/8 Save bit in carry flag and set 

) OF BA /5 ib BTS r/m32,imm8 6/8 6/8 Save bit in carry flag and set 



BTS saves the value of the bit indicated by the base (first operand) and the 
bit offset (second operand) into the carry flag and then stores 1 in the bit. 



CALL Call Procedure 



ODITSZAP 



■-J All flags are affected if a task switch occurs; no flags are affected if a task 

" 1 switch does not occur. 

v^ ) Opcode Instruction Clocks Description 



486 386 286* 86 

E8cv\^ CALLrel16 3 7+m 7 19 Call near, displacement 

relative to next instruction 

FF/2 CALLr/m16 5/5 7+m/10+m 7/11 16/21+EA Call near, register 

indirect/memory indirect 

9Acd CALLptr16:16 18,pm=20 17+m,pm=34=m 13,pm=26 28 Call intersegment, to full 

pointer given 
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Opcode Instruction 



Clocks 



Description 







486 


386 


286* 


9Acd 
9Acd 


CALLptr16:16 
CALLptr16:16 


pm=35 
pm=69 


pm=52+nfi 
pm=86+m 


41 
82 



86 



9Acd CALLptr16:16 pm=77+4x pnfi=94+4x+m 86+4x 
9Acd CALLptr16:16 pm=37+ts ts 177/182 

FF/3 CALL ml 6:1 6 17,pm=20 22+m,pm38+m 16/29 37+EA 

FF/3 CALLnfi16:16 pm=35 pm=56+m 44 

FF/3 CALLm16:16 pm=69 pm=90+m 83 

FF/3 CALLm16:16 pm=77+4x pm=98+4x+m 90+4x+m 

FF/3 CALLm16:16 pm=37+ts 5 + ts 180/185 

E8cd CALLrel32 3 7+m 

FF/2 CALLr/m32 5/5 7+m/10+m 

9Acp CALL ptrl 6:32 18,pm=20 17+m,pm=34+m 

9Acp CALL ptrl 6:32 pm=35 pm=52+m 
9Acp CALL ptrl 6:32 pm=69 pm=86+m 

9Acp CALLptr32:32 pm=77+4x pm=94+4x+m 

9Acp CALL ptrl 6:32 pm=37+ts ts 

FF/3 CALLm16:32 17,pm=20 22+m,pm=38+m 

FF/3 CALL ml 6:32 pm=35 pm=56+m 
FF/3 CALL ml 6:32 pm=69 pm=90+m 

FF/3 CALL ml 6:32 pm=77+4x pm=98+4x+m 

FF/3 CALL ml 6:32 pm=37+ts 5 + ts 

'Add one clock for each byte in the next instruction executed (80286 only). 

The CALL instruction causes the procedure named in the operand to be 
executed. When the procedure is complete (a return instruction is exe- 
cuted within the procedure), execution continues at the instruction that fol- 
lows the CALL instruction. 

The action of the different forms of the instruction are described next. 

Near calls are those with destinations of type r/ml6, r/m32, rell6, rel32; 
changing or saving the segment register value is not necessary. The CALL 
rell6 and CALL rel32 forms add a signed offset to the address of the 
instruction following CALL to determine the destination. The rell6 form 
is used when the instruction's operand-size attribute is 16 bits; rel32 is 
used when the operand-size attribute is 32 bits. The result is stored in the 
32-bit EIP register. With rel 16, the upper 16 bits of EIP are cleared, result- 
ing in an offset whose value does not exceed 16 bits. CALL r/ml6 and 



Call gate, same privilege 

Call gate, more privilege, 

no parameters 

Call gate, more privilege, 

X parameters 

Call to task (via task 

state segment/task gate 

for 286 

Call intersegment, 

address at r/m dword 

Call gate, same privilege 

Call gate, more privilege, 

no parameters 

Call gate, more privilege, 

X parameters 

Call to task (via task 

state segment/task gate 

for 286) 

Call near, displacement 

relative to next instruction 

Call near, indirect 

Call intersegment, to full 

pointer given 

Call gate, same privilege 

Call gate, more privilege, 

no parameters 

Call gate, more privilege, 

X parameters 

Call to task 

Call intersegment, 

address at r/m dword 

Call gate, same privilege 

Call gate, more privilege, 

no parameters 

Call gate, more privilege, 

X parameters 

Call to task 
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CALL r/m32 specify a register or memory location from which the abso- 
lute segment offset is fetched. The offset fetched from r/m is 32 bits for an 
operand-size attribute of 32 (r/m32), or 16 bits for an operand-size of 16 
(r/ml6). The offset of the instruction following CALL is pushed onto the 
stack. It will be popped by a near RET instruction within the procedure. 
The CS register is not changed by this form of CALL. 

The far calls, CALL ptrl6:16 and CALL ptr 16:32, use a 4-byte or 6-byte op- 
erand as a long pointer to the procedure called. The CALL ml6:16 and 
ml 6:32 forms fetch the long pointer from the memory location specified 
(indirection). In real address mode or virtual 8086 mode, the long pointer 
provides 16 bits for the CS register and 16 or 32 bits for the EIP register 
(depending on the operand-size attribute). These forms of the instruction 
push both CS and IP or EIP as a return address. 

In protected mode, both long pointer forms consult the AR byte in the de- 
scriptor indexed by the selector part of the long pointer. Depending on 
the value of the AR byte, the call will perform one of the following types 
of control transfers: 

■ a far call to the same protection level 
B an inter-protection level far call 
B a task switch 

Note: Turbo Assembler extends the syntax of the CALL instruction to facil- 
itate parameter passing to high-level language routines. See Chapter 7 of 
the Turbo Assembler User's Guide for more details. 



CBW Convert byte to word 



ODITSZAP 



Opcode Instruction Clocks Description 

486 386 286 86 
98 CBW 3 3 2 2 AX sign-extend of AL 

CBW converts the signed byte in AL to a signed word in AX by extending 
the most significant bit of AL (the sign bit) into all of the bits of AH. 
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CDQ Convert doubleword to quadword 

386 and i486 only 



Opcode Instruction Clocks Description 



486 386 
99 CDQ 3 2 EDX:EAX [(sign-extend of EAX) 

CDQ converts the signed doubleword in EAX to a signed 64-bit integer in 
the register pair EDX:EAX by extending the most significant bit of EAX 
(the sign bit) into all the bits of EDX. 



CLC Clear carry flag 



Opcode Instruction Clocks 



486 386 286 86 
F8 CLC 2 2 2 2 



CLC sets the carry flag to zero. It does not affect other flags or registers. 

CLD Clear direction flag 

ODITSZAPC 




Opcode Instruction 




Clocks 




Description 


C CLD 


486 
2 


386 286 
2 2 


86 
2 


Clear direction flag 



CLD clears the direction flag. No other flags or registers are affected. 
After CLD is executed, string operations will increment the index registers 
(SI or DI) that they use. 



CLI Clear interrupt flag 



Opcode Instruction Clocks 



486 386 286 86 
FA CLI 5 3 3 2 
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CLI clears the interrupt flag if the current privilege level is at least as privi- 
leged as lOPL. No other flags are affected. External interrupts are not rec- 
ognized at the end of the CLI instruction or from that point on until the in- 
terrupt flag is set. 

CLTS Clear task switched flag 

80286/386/1486 protected mode only 

ODITSZAPC 

TS = (TS is in CRO, not the flag register) 

Opcode Instruction Clocks 

486" 386 286 
OF 06 CLTS 7 5 2 



CLTS clears the task-switched (TS) flag in register CRO. This flag is set by 
the 386 every time a task switch occurs. The TS flag is used to manage 
J processor extensions as follows: 



■ Every execution of an ESC instruction is trapped if the TS flag if set. 

■ Execution of a WAIT instruction is trapped if the MP flag and the TS 
-^ flag are both set. 



Thus, if a task switch was made after an ESC instruction was begun, the 
processor extension's context may need to be saved before a new ESC in- 



3 struction can be issued. The fault handler saves the context and resets the 

J TSflag. 

-3 CLTS appears in operating system software, not in application programs. 

- ) It is a privileged instruction that can only be executed at privilege level 0. 



) CMC Complement carry flag 



Opcode Instruction 


Clocks 




Description 


486 
F5 CMC 2 


386 286 
2 2 


86 
2 


Complement carry flag 



CMC reverses the setting of the carry flag. No other flags are affected. 



C) 
Z) 
C) 

o 

Z) 
C3 
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CMP 



Opcode Instruction 



Compare two operands 



Cloci<s 



Description 







486 


386 


286 


86 




3Cib 


CMP AL,imm8 


1 


2 


3 


4 


Compare immediate byte to AL 


3Diw 


CMPAX,imm16 


1 


2 


3 


4 


Compare immediate word from AX 


3D id 


CMP EAX,imm32 


1 


2 






Compare immediate dword to EAX 


80 n ib 


CMP r/m8,imm8 


1/2 


2/5 


3/6 


4/10+EA 


Compare immediate byte to r/m byte 


81 n iw 


CMPr/m16,imm16 


1/2 


2/5 


3/6 


4/10+EA 


Compare immediate word to r/m word 


81/7 id 


CMP r/m32,imm32 


1/2 


2/5 






Compare immediate dword to r/m dword 


83 n ib 


CMPr/m16,imm8 


1/2 


2/5 


3/6 


4/10+EA 


Compare sign extended immediate byte 
to r/m word 


83/7ib 


CMP r/m32,imm8 


1/2 


2/5 






Compare sign extended immediate byte 
to r/m dword 


38 /r 


CMP r/m8,r8 


1/2 


2/5 


2/7 


3/9+EA 


Compare byte register to r/m byte 


39 /r 


CMPr/m16,r16 


1/2 


2/5 


2/7 


3/9+EA 


Compare word register to r/m word 


39 /r 


CMP r/m32,r32 


1/2 


2/5 






Compare dword register to r/m dword 


3A/r 


CMP r8,r/m8 


1/2 


2/6 


2/6 


3/9+EA 


Compare r/m byte to byte register 


3B/r 


CMPr16,r/m8 


1/2 


2/6 


2/6 


3/9+EA 


Compare r/m word to word register 


3B/r 


CMP r32,r/m32 


1/2 


2/6 






Compare r/m dword to dword register 



CMP subtracts the second operand from the first but, unUke the SUB in- 
struction, does not store the result; only the flags are changed. CMP is typ- 
ically used in conjunction with conditional jumps and the SETcc instruc- 
tion. If an operand greater than one byte is compared to an immediate 
byte, the byte value is first sign-extended. 



CMPS 
CMPSB 
CMPSW 
CMPSD 

Opcode Instruction 


Compare string operands 
CMPSD 386 and i486 only 


D 

* 


I 
Clocks 


T 


S 
* 


Z A P C 
* * * * 

Description 


486 
A6 CMPS m8,m8 8 

A7 CMPSm16,m16 8 

A7 CMPSm32,m32 8 

A6 CMPSB 8 
A7 CMPSW 8 
A7 CMPSD 8 


386 
10 

10 

10 

10 
10 
10 


286 
8 

8 

8 
8 


86 
22 

22 

22 
22 


Compare bytes ES:[(E)DI] (second operand) 
with [(E)SI} (first operand) 

Compare words ES:[(E)DI] (second operand) 

with [(E)SI] (first operand) 

Compare dwords ES:[(E)DI] (second operand) 

with [(E)SI] (first operand) 

Compare bytes ES:[(E)Di] with DS:[SI] 

Compare words ES:[(E)DI] with DS:[SI] 

Compare dwords ES:[(E)DI] with DS:[SI] 



CMPS compares the byte, word, or doubleword pointed to by the source- 
index register with the byte, word, or doubleword pointed to by the desti- 
nation-index register. 
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Z) 

o 

ZS) 
Zj 



-J 
Z) 

:j 

Zj 
Zj 
I) 
Zj 
Z) 



If the address-size attribute of this instruction is 16 bits, SI and DI will be 
used for source- and destination-index registers; otherwise ESI and EDI 
will be used. Load the correct index values into SI and DI (or ESI and 
EDI) before executing CMPS. 

The comparison is done by subtracting the operand indexed by the desti- 
nation-index register from the operand indexed by the source-index regis- 
ter. 

Note that the direction of subtraction for CMPS is [SI] - [DI] or [ESI] - 
[EDI]. The left operand (SI or ESI) is the source and the right operand (DI 
or EDI) is the destination. This is the reverse of the usual Intel convention 
in which the left operand is the destination and the right operand is the 
source. 

The result of the subtraction is not stored; only the flags reflect the 
change. The types of the operands determine whether bytes, words, or 
doublewords are compared. For the first operand (SI or ESI), the DS regis- 
ter is used, unless a segment override byte is present. The second operand 
(DI or EDI) must be addressable from the ES register; no segment over- 
ride is possible. 

After the comparison is made, both the source-index register and destina- 
tion-index register are automatically advanced. If the direction flag is 
(CLD was executed), the registers increment; if the direction flag is 1 (STD 
was executed), the registers decrement. The registers increment or decre- 
ment by 1 if a byte is compared, by 2 if a word is compared, or by 4 if a 
doubleword is compared. 

CMPSB, CMPSW and CMPSD are synonyms for the byte, word, and 
doubleword CMPS instructions, respectively. 

CMPS can be preceded by the REPE or REPNE prefix for block compari- 
son of CX or ECX bytes, words, or doublewords. Refer to the description 
of the REP instruction for more information on this, operation. 



CMPXCHG Compare and Exchange 
i486 only 



Opcode Instruction 



Clock 



Description 



OF A6/r CMPXCHG r/m8,r8 



0FA7/r CMPXCHG r/m16,r16 



486 

6/7 if comparison is 
successful; 6/10 if 
comparison fails 
6/7 if comparison is 
successful; 6/10 if 
comparison fails 



Compare AL with r/m byte. If equal, set ZF and 
load byte reg into r/m byte. Else, clear ZF and 
load r/m byte into AL. 

Compare AX with r/m word. If equal, set ZF 
and load word reg into r/m word. Else, clear ZF 
and load r/m word into AX. 
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Opcode Instruction Clock Description 



486 

0FA7/r CMPXCHG r/m32,r32 6/7 if comparisonis Compare EAX with r/m dword. If equal, set ZF 

successful; 6/10 if and load dword reg into r/m dword. Else, clear 
comparison fails ZF and load r/m dword into EAX. 

The CMPXCHG instruction compares the accumulator (AL, AX, or EAX 
register) with DEST. If they are equal, SRC is loaded into DEST. Other- 
wise, DEST is loaded into the accumulator. 

DEST is the destination operand; SRC is the source operand. 

Protected mode exceptions: #GP(0) if the result is in a nonwritable seg- 
ment; #GP(0) for an illegal memory operand effective address in the CS, 
DS, ES, FS, or GS segments; #SS(0) for an illegal address in the SS seg- 
ment; #PF (fault code) for a page fault; #AC for an unaligned memory 
reference if the current privilege level is 3. 

Real mode exception: interrupt 13 if any part of the operand would lie 
outside the effective address space from to OFFFFh. 

Virtual 8086 mode exceptions: interrupt 13, as in real mode; #PF and #AC, 
as in protected mode. 

Note: This instruction can be used with a LOCK prefix. In order to sim- 
plify interface to the processor's bus, the destination operand receives a 
write cycle without regard to the result of the comparison. DEST is writ- 
ten back if the comparison fails, and SRC is written into the destination 
otherwise. (The processor never produces a locked read without produc- 
ing a locked write.) 



CWD Convert word to doubleword 

386 and i486 only 



Opcode Instruction 


Clocks 




Description 


486 
99 CWD 3 


386 286 
2 2 


86 
5 


DX:AX <- sign-extend of AX 



CWD converts the signed word in AX to a signed doubleword in DX:AX 
by extending the most significant bit of AX into all the bits of DX. Note 
that CWD is different from CWDE. CWDE uses EAX as a destination, in- 
stead of DX:AX. 
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i) 

1) 

C 3 



1j 



CWDE Convert word to doubleword 

386 and i486 only 



Opcode Instruction 


Clocks 




Description 


486 
98 CWDE 3 


386 286 
3 


86 


EAX <- sign-extend of AX 



CWDE converts the signed word in AX to a doubleword in EAX by ex- 
tend-ing the most significant bit of AX into the two most significant bytes 
of EAX. Note that CWDE is different from CWD. CWD uses DX:AX 
rather than EAX as a destination. 



DAA Decimal adjust AL after addition 



Opcode 


instruction 


Clocks 




Description 


27 


486 
DAA 2 


386 286 
4 3 


86 
4 


Decimal adjust AL after addition 



J Execute DAA only after executing an ADD instruction that leaves a two- 

"j BCD-digit byte result in the AL register. The ADD operands should con- 

'[^ sist of two packed BCD digits. The DAA instruction adjusts AL to contain 

-' the correct two-digit packed decimal result. 



DAS Decimal adjust AL after subtraction 



Opcode Instruction 




Clocks 




Description 


2F DAS 


486 
2 


386 286 
4 3 


86 
4 


Decimal adjust AL after subtraction 



-J 

1) 

- . Execute DAS only after a subtraction instruction that leaves a two-BCD- 
'^^ digit byte result in the AL register. The operands should consist of two 
C) packed BCD digits. DAS adjusts AL to contain the correct packed two- 

- ^^ digit decimal result. 

I) 

C) 
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DEC 



Opcode instruction 



Decrement by 1 



Ciocl<s 



Description 







486 


386 


286 


86 




FE/1 


DEC r/m8 


1/3 


2/6 


2/7 


3/15+EA 


Decrement r/m byte by 1 


FF/1 


DECr/m16 


1/3 


2/6 


2/7 


3/15+EA 


Decrement r/m word by 1 




DEC r/m32 


1/3 


2/6 






Decrement r/m dword by 1 


48+rw 


DECr16 


1 


2 


2 


3 


Decrement word register by 1 


48+rw 


DEC r32 


1 


2 






Decrement dword register by 1 



DEC subtracts 1 from the operand. DEC does not change the carry flag. 
To affect the carry flag, use the SUB instruction with an immediate oper- 
and of 1. 



DIV 



Unsigned divide 



Opcode 


Instruction 


Clocl<s 






486 386 


F6/6 


DIV r/m8 


16/16 14/17 


F7/6 


D!Vr/m16 


24/24 22/25 


F7/6 


DIV r/m32 


40/40 38/41 



Description 



Unsigned divide AX by r/m byte (AL=QUO, AH=REM) 
Unsigned divide DX:AX by r/m word (AX=QUO, DX=REM) 
Unsigned divide EDX:EAX by r/m dword (EAX=QUO, EDX=REM) 



DIV performs an unsigned division. The dividend is implicit; only the di- 
visor is given as an operand. The remainder is always less than the divi- 
sor. The type of the divisor determines which registers to use as follows: 



Size 


Dividend 


Divisor 


Quotient 


Remainder 


byte 


AX 


r/m8 


AL 


AH 


word 


DX:AX 


r/m16 


AX 


DX 


dword 


EDX:EAX 


r/m32 


EAX 


EDX (386 only) 



ENTER 



Make stack frame for procedure parameters 
80186/286/386/486 only 



Opcode 


Instruction 


Clocks 






Description 


08 iw 00 
C8 iw 01 
C8 iw ib 


486 
Enter imm16,0 14 
Enter imm16,1 17 
Enter imm16,imm8 17+3n 


386 

10 

12 

15+4(n-i; 


286 

11 

15 

1 12+4(n 


■1) 


Make procedure stack frame 

Make stack frame for procedure parameters 

Make stack frame for procedure parameters 
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ENTER creates the stack frame required by most block-structured high- 
level languages. The first operand specifies the number of bytes of dy- 
namic storage allocated on the stack for the routine being entered. The sec- 
ond operand gives the lexical nesting level (0 to 31) of the routine within 
the high-level language source code. It determines the number of stack 
frame pointers copied into the new stack frame from the preceding frame. 
BP (or EBP, if the operand-size attribute is 32 bits) is the current stack 
. y frame pointer. 

If the operand-size attribute is 16 bits, the processor uses BP as the frame 
■' pointer and SP as the stack pointer. If the operand-size attribute is 32 bits, 

) the processor uses EBP for the frame pointer and ESP for the stack pointer. 

If the second operand is 0, ENTER pushes the frame pointer (BP or EBP) 
3 onto the stack; ENTER then subtracts the first operand from the stack 

pointer and sets the frame pointer to the current stack-pointer value. 

-J For example, a procedure with 12 bytes of local variables would have an 

; ENTER 12,0 instruction at its entry point and a LEAVE instruction before 

every RET. The 12 local bytes would be addressed as negative offsets 
from the frame pointer. 



w^ 



HLT Halt 



ODITSZAPC 



Z) 



■—' HLT stops instruction execution and places the x86 in a HALT state. An 

^) enabled interrupt, NMI, or a reset will resume execution. If an interrupt 

(including NMI) is used to resume execution after HLT, the saved CS:IP 
(or CS:EIP on an 386) value points to the instruction following HLT. 



Opcode 


Instruction 


Clocks 




Description 


F4 


486 
HLT 4 


386 286 
5 2 


86 
2 


Halt 



IDIV Signed divide 



•? •? •? "5 •? -3 

J 

^y Opcode Instruction Clocl<s Description 

'J 486 386 286 86 

--, F6/7 IDIVr/m8 19/20 19 17/20 101-1 12/107-1 18+EA Signed divide AX by r/m byte 

-^ (AL=QUO, AH=REM) 

') nil IDIVr/m16 27/28 27 25/28 165-1 84/1 71 -190+EA Signed divide DX:AX by EA word 

(AX=QUO, DX=REM) 
D F7/7 IDiVr/m32 43/44 43 Signed divide EDX:EAX by DWORD 
byte (EAX=QUO, EDX=REM) 
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IDIV perforins a signed division. The dividend, quotient, and remainder 
are implicitly allocated to fixed registers. Only the divisor is given as an 
explicit r/m operand. The type of the divisor determines which registers 
to use as follows: 



Size 


Divisor 


Quotient 


Remainder 


Dividend 


byte 


r/m8 


AL 


AH 


AX 


word 


r/m16 


AX 


DX 


DX:AX 


dword 


r/m32 


EAX 


EDX 


EDX:EAX (386 only) 



If the resulting quotient is too large to fit in the destination, or if the divi- 
sion is 0, an Interrupt is generated. Nonintegral quotients are truncated 
toward 0. The remainder has the same sign as the dividend and the abso- 
lute value of the remainder is always less than the absolute value of the di- 
visor. 



IMUL Signed nnultiply 



Opcode Instruction Clocks Description 

486 386 286 86 

F6/5 IMULr/m8 13-18/13-18 9-14/12-17 13/16 80-98/86-104 AX <-AL* r/m byte 

+EA 
F7/5 IMULr/m16 13-26/13-26 9-22/12-25 21/24 128-154/134- DX:AX<- AX* r/m word 

160+EA 
F7/5 IMULr/m32 12-42/13-42 9-38/12-41 EDX:EAX <-EAX* r/m dword 

OFAF/r IML)Lr16,r/m16 13-26/13-26 9-22/12-25 word register <-word register * 

r/m word 
OFAF/r IMUL r32,r/m32 13-42/13-42 9-38/12-41 dword register <-dword register 

* r/m dword 

6B/rib IMULr16,r/ 13-26/13-26 9-14/12-17 21/24 word register <-r/m1 6* 

m16,imm8 sign-extended immediate byte 

6B/rib IMULr32,r/ 13-42 9-14/12-17 dword register <-r/m32 * 

m32,imm8 sign-extended immediate byte 

6B/rib IMULr16,imm8 13-26 9-14/12-17 21/24 word register <-word register * 

sign-extended immediate byte 

6B/rib IMULr32,imm8 13-42 9-14/12-17 dword register ^word register 

* sign-extended immediate byte 
69/riw IMULr16,r/ 13-26/13-26 9-22/12-25 21/24 word register <-r/m1 6 

m16,imm16 immediate word 

69 /rid liVIULr32,r/ 13-42/13-42 9-38/12-41 dword register r/m32 * 

m32,imm32 immediate dword 

69/riw IMULr16,imm16 13-26/13-26 9-22/12-25 word register <-r/m1 6 * 

immediate word 
69 /rid ll\/IUL r32,imm32 13-42/13-42 9-38/12-41 dword register <-r/m32 * 
immediate dword 

IMUL performs signed multiplication. Some forms of the instruction use 
implicit register operands. The operand combinations for all forms of the 
instruction are shown in the "Description" column above. 
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IMUL clears the overflow and carry flags under the following conditions: 
Instruction form Condition for clearing CF and OF 



r/m8 

r/ml6 

r/m32 

rl6,r/ml6 

r32,r/m32 

rl 6,r/ml 6,imml 6 

r32,r/m32,imm32 



AL = sign-extend of AL to 16 bits 

AX = sign-extend of AX to 32 bits 

EDX:EAX = sign-extend of EAX to 32 bits 

Result exactly fits within rl6 

Result exactly fits within r32 

Result exactly fits within rl6 

Result exactly fits within r32 



IN 



Input from port 



Opcode Instruction 



Clocks 



:j 
:.) 

C) 



E4ib 

E5ib 

E5ib 

EC 

ED 

ED 



486 



386 



lALJmmS 14,pm=8V28",vm=27 12,pm=6*/26" 5 

IAX,imm8 14,pm=8*/28**,vm=27 12,pm=6V26" 5 

IEAX,imm8 14,pm=8728",vm=27 12,pm=6726" 

lAUDX 14,pm=8728**,vm=27 13,pm=7727" 5 

lAX.DX 14,pm=8728",vm=27 13,pm=7727" 5 

lEAX.DX 14,pm=8728",vm=27 13,pm=7727** 



286 86 
10 



10 



Input byte from 
immediate port into AL 
Input word from 
immediate port into AX 
Input dword from 
immediate port into EAX 
Input byte from port DX 
Into AL 

Input word from port DX 
into AX 

Input dword from port 
DX into EAX 



*lfCPL<IOPL 

"If CPL > lOPL or if in virtual 8086 mode 



IN transfers a data byte or data word from the port numbered by the sec- 
ond operand into the register (AL, AX, or EAX) specified by the first oper- 
and. Access any port from to 65535 by placing the port number in the 
DX register and using an IN instruction with DX as the second parameter. 
These I/O instructions can be shortened by using an 8-bit port I/O in the 
instruction. The upper eight bits of the port address will be when 8-bit 
port I/O is used. 



^.J 



INC 



Increment by 1 



I) 



Opcode Instruction 



FE/0 
FF/0 



Clocks 



Description 



INC r/m8 
INC r/m16 



1/3 
1/3 



386 
2/6 
2/6 



286 
2/7 
2/7 



86 

3/15+EA 

3/15+EA 



Increment r/m byte by 1 
Increment r/m word by 1 
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Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




FF/6 


INC r/m32 


1/3 








Increment r/m dword by 1 


40+ rw 


INCr16 


1 


2 


2 


3 


Increment word register by 1 


40+ rd 


INC r32 


1 








Increment dword register by 1 



INC adds 1 to the operand. It does not change the carry flag. To affect the 
carry flag, use the ADD instruction with a second operand of 1 . 



INS 




Input from port to string 






INSB 




80186/286/386/486 only 






INSW 




















INSD 




D I T S 


Z A 


P c 




Opcode 


Instruction 




Clocks 




Description 






486 


386 


286 




6C 


INS r/m8,DX 


17,pm=10*/32",vm=30 


15,pm=9V29** 


5 


Input byte from port 
DX into ES:(E)DI 


6D 


INS r/m16,DX 


17,pm=10'/32**,vm=30 


15,pm=9*/29** 


5 


Input word from port 
DX into ES:(E)DI 


6D 


INS r/m32,DX 


17,pm=10732**,vm=30 


15,pm=9729** 




Input dword from 
port DX into ES:(E)DI 


6C 


INSB 


17,pm=10*/32",vm=30 


15,pm=9*/29" 


5 


Input byte from port 
DX into ES:(E)DI 


6D 


INSW 


17,pm=10*/32",vm=30 


15,pm=9*/29" 


5 


Input word from port 
DX into ES:(E)DI 


6D 


INSD 


17,pm=10732",vm=30 


15,pm=9*/29** 




Input dword from 
port DX into ES:(E)DI 


*lf CPL < 


iOPL 










"If CPL > 


■ IOPL or if in virtual 8086 mode 









INS transfers data from the input port numbered by the DX register to the 
memory byte or word at ES:dest-index. The memory operand must be ad- 
dressable from ES; no segment override is possible. The destination regis- 
ter is DI if the address-size attribute of the instruction is 16 bits, or EDI if 
the address-size attribute is 32 bits. 

INS does not allow the specification of the port number as an immediate 
value. The port must be addressed through the DX register value. Load 
the correct value into DX before executing the INS instruction. 

The destination address is determined by the contents of the destination 
index register. Load the correct index into the destination index register 
before executing INS. 

After the transfer is made, DI or EDI advances automatically. If the direc- 
tion flag is (CLD was executed), DI or EDI increments; if the direction 
flag is 1 (STD was executed), DI or EDI decrements. DI increments or dec- 
rements by 1 if a byte is input, by 2 if a word is input, or by 4 if a 
doubleword is input. 
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INSB, INSW and INSD are synonyms of the byte, word, and doubleword 
INS instructions. INS can be preceded by the REP prefix for block input of 
CX bytes or words. Refer to the REP instruction for details of this oper- 
ation. 



w^ 



J 


INT 
INTO 




Call to interrupt procedure 




) 














1 






D 


I T 



s z 


A 


P c 


J 


Opcode 


Instruction 




Clocks 






Description 








486 


386 


286 


86 




-"' 


CC 


INT3 


26 


33 


23 


52 


Interrupt 3--trap to debugger 




CC 


INT3 


44 


pm=59 


40 




interrupt 3--protected mode 




CC 


INT3 


71 


pm=99 


78 




Interrupt 3--prolected mode 


-■■ 


CC 


INT3 


82 


pm=119 






Interrupt 3--from \/86 mode to 
PLO 


^ 


CC 


INT3 


37+ts 


ts 


167 




Interrupt 3--protected mode 


-' 


CDib 


INTimmS 


30 


37 


23 


51 


Interrupt numbered by 
immediate byte 


' 


CDib 


INTimmS 


44 


pm=59 


40 




Interrupt-protected mode 


■l 


CDib 


INTimmS 


77 


pm=99 


78 




Interrupt-protected mode 




CDib 


INTimmS 


86 


pm=119 






lnterrupt--from V86 mode to PLO 


J 


CDib 


INTimmS 


37+ts 


ts 


167 




Interrupt-protected modo 


3 


CE 


INTO 


Pass:28, 


Fail:3, pm=3; 


Fail:3, 


Fail:4, 


Interrupt 4--if overflow flag is 1 








Fail;3 


Pass:35 


Pass-.24 


Pass:53 




_} 


CE 


INTO 


46 


pm=59 


41 




Interrupt 4--Protected mode 


, 


CE 


INTO 


73 


pm=99 


79 




Interrupt 4--Protected mode 


J 


CE 


INTO 


84 


pm=119 






Interrupt 4--from V86 mode to 


3 














PLO 




CE 


INTO 


39+ts 


ts 


168 




Interrupt 4--Protected mode 


\ 


* Add one clock for each byte of the next instruction executed (80286 only). 





ZJ 



The INT n instruction generates via software a call to an interrupt han- 
dler. The immediate operand, from to 255, gives the index number into 
the interrupt descriptor table (IDT) of the interrupt routine to be called. In 
protected mode, the IDT consists of an array of eight-byte descriptors; the 
descriptor for the interrupt invoked must indicate an interrupt, trap, or 
task gate. In real address mode, the IDT is an array of four byte-long 
pointers. In protected and real address modes, the base linear address of 
the IDT is defined by the contents of the IDTR. 

The INTO conditional software instruction is identical to the INT n inter- 
rupt instruction except that the interrupt number is implicitly 4, and the 
interrupt is made if the 86, 286, or 386 overflow flag is set. 

The first 32 interrupts are reserved by Intel for system use. Some of these 
interrupts are use for internally generated exceptions. 

INT n generally behaves like a far call except that the flags register is 
pushed onto the stack before the return address. Interrupt procedures re- 
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turn via the IRET instruction, which pops the flags and return address 
from the stack. 

In real address mode, INT n pushes the flags, CS and the return IP onto 
the stack, in that order, then jumps to the long pointer indexed by the in- 
terrupt number. 



INVD Invalidate cache 

I486 only 



Opcode Instruction Clock Description 



486 
OF 08 INVD 4 Invalidate entire cache 



The internal cache is flushed, and a special-function bus cycle is issued 
which indicates that external caches should also be flushed. Data held in 
write-back external caches is discarded. 

Note: This instruction is implementation-dependent; its function might be 
implemented differently on future Intel processors. 

It is the responsibility of hardware to respond to the external cache flush 
indication. 



INVLPG Invalidate TLB entry 

i486 only 



Opcode Instruction Clock Description 



486 
OF 01/7 INVLPG m 12 for hit Invalidate TLB entry 



The INVLPG instruction is used to invalidate a single entry in the TLB, 
the cache used for table entries. If the TLB contains a valid entry that 
maps the address of the memory operand, that TLB entry is marked in- 
valid. 

In both protected mode and virtual 8086 mode, an invalid opcode is gener- 
ated when used with a register operand. 

Note: This instruction is implementation-dependent; its function might be 
implemented differently on future Intel processors. 
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IRET 
IRETD 



Interrupt return 

IRETD 386 and i486 only 



.^ J 



The flags register is popped from stack. 



Opcode Instruction 



Clocks 



Description 





486 


386 


286 




86 




CF IRET 


15 


22,pm=38 


17,pm= 


=31 


32 


Interrupt return (far return and pop flags) 


CF IRET 


36 


pm=82 


55 






Interrupt return 


CF IRET 


ts+32 


ts 


169 






Interrupt return 


CF IRETD 


15 


22,pm=38 








Interrupt return (far return and pop flags) 


CF IRETD 


36 


pm=82 








Interrupt return to lesser privilege 


CF IRETD 


15 


pm=60 








Interrupt return to V86 mode 


CF IRETD 


ts+32 


ts 








Interrupt return 


* Add one clock, for each byte in 


the next instruction executed (80286 only). 



In real address mode, IRET pops the instruction pointer, CS, and the flags 
register from the stack and resumes the interrupted routine. 

In protected mode, the action of IRET depends on the setting of the 
nested task flag (NT) bit in the flag register. When popping the new flag 
image from the stack, the lOPL bits in the flag register are changed only 
when CPL equals 0. 

If NT equals 0, IRET returns from an interrupt procedure without a task 
switch. The code returned to must be equally or less privileged than the 
interrupt routine (as indicated by the RPL bits of the CS selector popped 
from the stack). If the destination code is less privileged, IRET also pops 
the stack pointer and SS from the stack. 

If NT equals 1, IRET reverses the operation of a CALL or INT that caused 
a task switch. The updated state of the task executing IRET is saved in its 
task state segment. If the task is re-entered later, the code that follows 
IRET is executed. 



Jcc 



Jump if condition is met 



O 



3 



Opcode 



Instruction 



Clocks 



Description 



77 cb 
73 cb 
72 cb 
76 cb 

72 cb 



JA rel8 
JAE rel8 
JB reI8 
JBE rel8 

JC rel8 



486 

3/1 

3/1 

3/1 

3/1 

3/1 



386 

7+m,3 

7+m+,3 

7+m,3 

7+m,3 



286 
7,3 
7,3 
7,3 
7,3 



86 

16,4 

16,4 

16,4 

16,4 



7+m,3 7,3 16,4 



Jump short if above (CF=0 and ZF=0) 

Jump short if above or equal (CF=0) 

Jump short if betovj (CF=1) 

Jump short if belovi/ or equal (CF=1 or 

ZF=1) 

Jump short if carry (CF=1) 



PART 4, Processor Instructions 



83 



Opcode 



Instruction 



Clocks 



Description 







486 


386 


286 


86 


E3cb 


JCXZ rel8 


3/1 


9+m,5 


8,4 


18,6 


E3cb 


JECXZ rel8 


3/1 


9+m,5 






74 cb 


JE rel8 


3/1 


7+m,3 


7,3 


16,4 


74 cb 


JZ rel8 


3/1 


7+m,3 


7,3 


16,4 


7Fcb 


JG rel8 


3/1 


7+m,3 


7,3 


16,4 


7Dcb 


JGE rel8 


3/1 


7+ni,3 


7,3 


16,4 


7Ccb 


JL rel8 


3/1 


7+m,3 


7,3 


16,4 


7Ecb 


JLE rel8 


3/1 


7+m,3 


7,3 


16,4 


76 cb 


JNA rel8 


3/1 


7+m,3 


7,3 


16,4 


72 cb 


JNAE rel8 


3/1 


7+m,3 


7,3 


16,4 


73 cb 


JNB rel8 


3/1 


7+m,3 


7,3 


16,4 


77 cb 


JNBE rel8 


3/1 


7+m,3 


7,3 


16,4 


73 cb 


JNC rel8 


3/1 


7+m,3 


7,3 


16,4 


75 cb 


JNE rel8 


3/1 


7+m,3 


7,3 


16,4 


7Ecb 


JNG rel8 


3/1 


7+[Ti,3 


7,3 


16,4 


7Ccb 


JNGE rel8 


3/1 


7+m,3 


7,3 


16,4 


7Dcb 


JNL relS 


3/1 


7+m,3 


7,3 


16,4 


7Fcb 


JNLE rel8 


3/1 


7+m,3 


7,3 


16,4 


71 cb 


JNO rel8 


3/1 


7+m,3 


7,3 


16,4 


7Bcb 


JNP rel8 


3/1 


7+m,3 


7,3 


16,4 


79 cb 


JNS rel8 


3/1 


7+m,3 


7,3 


16,4 


75 cb 


JNZ rel8 


3/1 


7+m,3 


7,3 


16,4 


70 cb 


JO rel8 


3/1 


7+m,3 


7,3 


16,4 


7Acb 


JP rel8 


3/1 


7+m,3 


7,3 


16,4 


7Acb 


JPE rel8 


3/1 


7+m,3 


7,3 


16,4 


7Bcb 


JPO rel8 


3/1 


7+m,3 


7,3 


16,4 


78 cb 


JS rel8 


3/1 


7+m,3 


7,3 


16,4 


74 cb 


JZ rel8 


3/1 


7+m,3 


7,3 


16,4 


OF 87 cw/cd 


JA re!16/32 


3/1 


7+m,3 






OF 83 cw/cd 


JAE re!16/32 


3/1 


7+m,3 






OF 82 cw/cd 


JBrel16/32 


3/1 


7+m,3 






OF 86 cw/cd 


JBErel16/32 


3/1 


7+rTi,3 






OF 82 cw/cd 


JCrel16/32 


3/1 


7+m,3 






OF 84 cw/cd 


JErel16/32 


3/1 


7+m,3 






OF 84 cw/cd 


JZrel16/32 


3/1 


7+m,3 






OF 8F cw/cd 


JG rel16/32 


3/1 


7+m,3 






OF 8D cw/cd 


JGE re!16/32 


3/1 


7+m,3 






OF 8C cw/cd 


JLre!16/32 


3/1 


7+m,3 






OF 8E cw/cd 


JLE re!1 6/32 


3/1 


7+m,3 






OF 86cw/cd 


JNA re!1 6/32 


3/1 


7+m,3 






OF 82 cw/cd 


JNAE re!1 6/32 


3/1 


7+m,3 






OF 83 cw/cd 


JNB rel1 6/32 


3/1 


7+m,3 






OF 87 cw/cd 


JNBE rel1 6/32 


3/1 


7+m,3 






OF 83 cw/cd 


JNC rel16/32 


3/1 


7+m,3 






OF 85 cw/cd 


JNE rel16/32 


3/1 


7+m,3 






OF 8E cw/cd 


JNG rel1 6/32 


3/1 


7+m,3 






OF 8C cw/cd 


JNGE re.l1 6/32 


3/1 


7+m,3 






OF 8D cw/cd 


JNLrel16/32 


3/1 


7+m,3 







Jump short if CX register is 

Jump short if ECX register is 

Jump short if equal (ZF=1) 

Jump short if 0(ZF=1) 

Jump short if greater (ZF=0 and SF=OF) 

Jump short if greater or equal (SF=OF) 

Jump short if less (SFoOF) 

Jump short if less or equal (ZF=1 and 

SFoOF) 

Jump short if not above (CF=1 or ZF=1) 

Jump short if not above or equal (CF=1) 

Jump short if not below (CF=0) 

Jump short if not below or equal (CF=0 

and ZF=0) 

Jump short if not carry (CF=0) 

Jump short if not equal (ZF=0) 

Jump short if not greater (ZF=1 or 

SFoOF) 

Jump short if not greater or equal 

(SFoOF) 

Jump short if not less (SF=OF) 

Jump short if not less or equal (ZF=0 and 

SF=OF) 

Jump short if not overflow (OF=0) 

Jump short if not parity (PF=0) 

Jump short if not sign (SF=0) 

Jump short if not zero (ZF=0) 

Jump short if overflow (0F=1) 

Jump short if parity (PF=1) 

Jump short if parity even (PF=1) 

Jump short if parity odd (f^F=0) 

Jump short if sign (SF=1) 

Jump short of zero (ZF=1) 

Jump near if above (CF=0 and ZF=0) 

Jump near if above or equal (CF=0) 

Jump near if below (CF=1) 

Jump near if below or equal (CF=1or ZF=1) 

Jump near if carry (CF=1) 

Jump near if equal (ZF=1) 

Jump near if (ZF=1) 

Jump near if greater (ZF=0 and SF=OF) 

Jump near if greater or equal (SF=OF) 

Jump near if less (SFoOF) 

Jump near if less or equal(ZF=1 and 

SFoOF) 

Jump near if not above (CF=1 or ZF=1) 

Jump near if not above or equal (CF=1) 

Jump near if not below (CF=0) 

Jump near if not below or equal (CF=0 

and ZF=0 

Jump near if not carry and ZF=0) 

Jump near if not equal (ZF=0) 

Jump near if not greater (ZF=1 or SFoOF) 

Jump near if not greater or equal (SFoOF) 

Jump near if not less (SF=OF) 
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Opcode 



Instruction 



Clocks 



Description 







486 


386 


OF 8F cw/cd 


JNLErel16/32 


3/1 


7+m,3 


OF 81 cw/cd 


JNOrel16/32 


3/1 


7+m,3 


OF SB cw/cd 


JNP rel16/32 


3/1 


7+m,3 


OF 89 cw/cd 


JNS ran 6/32 


3/1 


7+m,3 


OF 85 cw/cd 


JNZ rel 16/32 


3/1 


7+m,3 


OF 80 cw/cd 


JO rel 16/32 


3/1 


7+m,3 


OF 8A cw/cd 


JP rel16/32 


3/1 


7+m,3 


OF 8A cw/cd 


JPE rel16/32 


3/1 


7+m,3 


OF 8B cw/cd 


JPO rail 6/32 


3/1 


7+m,3 


OF 88 cw/cd 


JS rel 16/32 


3/1 


7+m,3 


OF 84 cw/cd 


JZ rel 16/32 


3/1 


7+m,3 



286 86 



Jump near if not less or equal (ZF=0 and 

SF=OF) 

Jump near if not overflow (OF=0) 

Jump near if not parity (PF=0) 

Jump near if not sign (SF=0) 

Jump near if not zero (ZF=0) 

Jump near if overflow (0F=1) 

Jump nearif parity (PF=1) 

Jump near if parity even (PF=1) 

Jump near if parity odd (PF=0) 

Jump nearif sign (SF=1) 

Jump near if zero (ZF=1) 



* When a jump is taken, add one clock for every byte of the next instruction executed (80286 only). 



-J 



Note: The first clock count is for the true condition (branch taken); the sec- 
ond clock count is for the false condition (branch not taken). rell6/32 indi- 
cates that these instructions map to two; one with a 16-bit relative dis- 
placement, the other with a 32-bit relative displacement, depending on 
the operand-size attribute of the instruction. 

Conditional jumps (except JCXZ/JECXZ) test the flags which have been 
set by a previous instruction. The conditions for each mnemonic are given 
in parentheses after each description above. The terms "less" and "greater" 
are used for comparisons of signed integers; "above" and "below" are used 
for unsigned integers. 

If the given condition is true, a jump is made to the location provided as 
the operand. Instruction coding is most efficient when the target for the 
conditional jump is in the current code segment and within -128 to -i- 127 
bytes of the next instruction's first byte. The jump can also target -32768 
through +32767 (segment size attribute 16) or -2 to the 31st power +2 to 
the 31st power -1 (segment size attribute 32) relative to the next 
instruction's first byte. When the target for the conditional jump is in a dif- 
ferent segment, use the opposite case of the jump instruction (that is, JE 
and JNE), and then access the target with an unconditional far jump to 
the other segment. For example, you cannot code 



JZ FARLABEL; 

You must instead code 

JNZ BEYOND; 
JMP FARLABEL; 
BEYOND : 

Because there can be several ways to interpret a particular state of the 
flags, TASM provides more than one mnemonic for most of the condi- 
tional jump opcodes. For example, if you compared two characters in AX 
and want to jump if they are equal, use JE; or, if you ANDed AX with a 
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bit field mask and only want to jump if the result is 0, use JZ, a synonym 
for JE. 

JCXZ/JECXZ differs from other conditional jumps because it tests the con- 
tents of the CX or ECX register for 0, not the flags. JCXZ/JECXZ is useful 
at the beginning of a conditional loop that terminates with a conditional 
loop instruction (such as LOOPNE TARGET LABET.). The JCXZ/JECXZ 
prevents entering the loop with CX or ECX equal to zero, which would 
cause the loop to execute 64K or 32G times instead of zero times. 



JMP Jump 

ODITSZAPC 

All if a task switch takes place; none if no task switch occurs 

Opcode Instruction Clocks Description 







486 




386 


286 


86 




EBcb 


JMP relB 


3 




7+m 


7 


15 


Jump short 


E9cw 


JMPrelie 


3 




7+m 


7 


15 


Jump near 


FF/4 


JMP r/m16 


5/5 




7+m/10+m 


7/11 


11/18+EA 


Jump near indirect 


EAcd 


JMPptr16:16 


17pm= 


19 


12+m, pm=27+m 


11,pm=23 


15 


Jump intersegment, 4-byte 
immediate address 


EAcd 


JMPptr16:16 


32 




pm=45+m 


38 




Jump to call gate, same 
privilege 


EAcd 


JMPptr16:16 


42+ts 




ts 


175 




Jump via task state 
segment 


EAcd 


JMPptr16:16 


43+ts 




ts 


180 


24+EA 


Jump via task gate 


FF/5 


JMPm16:16 


13,pm= 


=18 


43+m,pm=31+m 


15,pm=26 




Jump r/ml 6:1 6 indirect 
and intersegment 


FF/5 


JMPm16:16 


31 




pm=49+m 


41 




Jump to call gate, same 
privilege 


FF/5 


JMPm16:16 


41+ts 




5+ts 


178 




Jump via task state 
segment 


FF/5 


JMPm16:16 


42+ts 




5+ts 


183 




Jump via task gate 


E9cd 


JMP rel32 


3 




7+m 






Jump near 


FF/4 


JMP r/m32 


5/5 




7+m,10+m 






Jump near 


EAcp 


JMP ptr1 6:32 


13,pm= 


=18 


12+m, pm=27+m 






Jump intersegment, 6-byte 
immediate address 


EAcp 


JMP ptn 6:32 


31 




pm=45+m 






Jump to call gate, same 
privilege 


EAcp 


JMP ptn 6:32 


42+ts 




ts 






Jump via task state 
segment 


EAcp 


JMP ptr1 6:32 


43+ts 




ts 






Jump via task gate 


FF/5 


JMP m16:32 


13,pm: 


=18 


43+m, pm=31+m 






Jump intersegment 
address at r/m dword 


FF/5 


JMP m16:32 


31 




pm=49+m 






Jump to call gate, same 
privilege 


FF/5 


JMP m16:32 


41+ts 




5 + ts 






Jump via task state 
segment 


FF/5 


JMP m1 6:32 


42+ts 




5 + ts 






Jump via task gate 


* Add one clock for every byte of the next instruction executed (80286 only). 
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The JMP instruction transfers control to a different point in the instruction 
stream without.recording return information. 

The action of the various forms of the instruction are shown below. 

Jumps with destinations of type r/ml6, r/m32, rell6, and rel32 are near 
jumps and do not involve changing the segment register value. 

The JMP"rell6 and JMP rel32 forms of the instruction add an offset to the 
address of the instruction following the JMP to determine the destination. 
The rell6 form is used when the instruction's operand-size attribute is 16 
bits (segment size attribute 16 only); rel32 is used when the operand-size 
attribute is 32 bits (segment size attribute 32 only). The result is stored in 
the 32-bit EIP register. With rell6, the upper 16 bits of EIP are cleared, 
which results in an offset whose value does not exceed 16 bits. 

JMP r/ml6 and JMP r/m32 specifies a register or memory location from 
which the absolute offset from the procedure is fetched. The offset fetched 
from r/m is 32 bits for an operand-size attribute of 32 bits (r/m32), or 16 
bits for an operand-size attribute of 16 bits (r/ml6). 

The JMP ptrl6:16 and ptrl6:32 forms of the instruction use a four-byte or 
six-byte operand as a long pointer to the destination. The JMP ml6:16 and 
ml6:32 forms fetch the long pointer from the memory location specified 
(indirection). In real address mode or virtual 8086 mode, the long pointer 
provides 16 bits for the CS register and 16 or 32 bits for the EIP register 
(depending on the operand-size attribute). In protected mode, both long 
pointer forms consult the access rights (AR) byte in the descriptor indexed 
by the selector part of the long pointer. Depending on the value of the AR 
byte, the jump will perform one of the following types of control transfers: 

■ a jump to a code segment at the same privilege level 

■ a task switch 



LAHF Loads flags into AH register 



ODITSZAPC 



Opcode Instruction Clocks Description 

486 386 286 86 
9F LAHF 3 2 2 4 Load: AH = flags SF ZF xx AF xx PF xx CF 



) LAHF transfers the low byte of the flags word to AH. The bits, from MSB 

to LSB, are sign, zero, indeterminate, auxiliary carry, indeterminate, par- 
ity, indeterminate, and carry. 



-J 
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LAR Load access rights byte 

80286/386/486 protected mode only 



Opcode Instruction Clocks Description 







486 386 


286 


0F02/r 


LARr16,r/m16 


11/11 pm=15/16 


14/16 r16<-r/m16 masked by FFOO 


OF 02 /r 


LAR r32,r/m32 


11/11 pm=15/16 


r32<-r/m32 masked by OOFxFFOO 



The LAR instruction stores a marked form of the second doubleword of 
the descriptor for the source selector if the selector is visible at the CPL 
(modified by the selector's RPL) and is a valid descriptor type. The desti- 
nation register is loaded with the high-order doubleword of the descriptor 
masked by OOFxFFOO, and ZF is set to 1. The x indicates that the four bits 
corresponding to the upper four bits of the limit are undefined in the 
value loaded by LAR. If the selector is invisible or of the wrong type, ZF 
is cleared. 

If the 32-bit operand size is specified, the entire 32-bit value is loaded into 
the 32-bit destination register. If the 16-bit operand size is specified, the 
lower 16-bits of this value are stored in the 16-bit destination register. 

All code and data segment descriptors are valid for LAR. (See your Intel 
manual for valid segment and gate descriptor types for LAR.) 



LEA Load effective address offset 



A P 



Opcode Instruction Clocks Description 





i 


186 


386 


286 


86 


8D/r 


LEAr16,m 




2 


3 


2+EA 


8D/r 


LEA r32,m 




2 






8D/r 


LEAr16,m 




2 






8D/r 


LEA r32,m 




2 







Store effective address for m in register r16 
Store effective address for m in register r32 
store effective address for m in register r16 
Store effective address for m in register r32 



LEA calculates the effective address (offset part) and stores it in the speci- 
fied register. The operand-size attribute of the instruction is determined 
by the chosen register. The address-size attribute is determined by the 
USE attribute of the segment containing the second operand. The address- 
size and operand-size attributes affect the action performed by LEA, as fol- 
lows: 
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Operand Address Action 
size size performed 

16 16 16-bit effective address is calculated and stored 

in requested 16-bit register destination. 

16 32 32-bit effective address is calculated. The lower 

16 bits of the address are stored in the requested 
16-bit register destination. 

32 16 16-bit effective address is calculated. The 16-bit 

address is zero-extended and stored in the re- 
quested 32-bit register destination. 

32 32 32-bit effective address is calculated and stored in 

the requested 32-bit register destination. 



LEAVE 



Opcode Instruction 



High-level procedure exit 
80186/286/386/486 only 



Clocks 



Description 



C9 
C9 


LEAVE 
LEAVE 


486 

5 

5 


386 

4 

4 


286 
5 


Set SP to BP 
Set ESP to EBP 



LEAVE reverses the actions of the ENTER instruction. By copying the 
frame pointer to the stack pointer, LEAVE releases the stack space used 
by a procedure for its local variables. The old frame pointer is popped 
into BP or EBP, restoring the caller's frame. A subsequent RET nn instruc- 
tion removes any arguments pushed onto the stack of the exiting proce- 
dure. 



LGDT/LIDT Load global/interrupt descriptor table register 
80286/386/486 protected mode only 






Opcode Instruction 



Clocks 



Description 







486 


386 


286 




OF 01 /2 


LGDTm16&32 


11 


11 


11 


Load m into global descriptor table register 


OF 01 /3 


LIDTm16&32 


11 


11 


12 


Load m into interrupt descriptor table register 



The LGDT and LIDT instructions load a linear base address and limit 
value from a six-byte data operand in memory into the GDTR or IDTR, 
respectively. If a 16-bit operand is used with LGDT or LIDT, the register 
is loaded with a 16-bit limit and a 24-bit base, and the high-order 8 bits of 
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the 6-byte data operand are not used. If a 32-bit operand is used, a 16-bit 
limit and a 32-bit base is loaded; the high-order 8 bits of the 6-byte oper- 
and are used as high-order base address bits. 

The SGDT and SIDT instructions always store into all 48 bits of the 6-byte 
data operand. With the 80286, the upper 8 bits are undefined after SGDT 
or SIDT is executed. With the 386, the upper 8 bits are written with the 
high-order 8 address bits, for both a 16-bit operand and a 32-bit operand. 
If LGDT or LIDT is used with a 16-bit operand to load the register stored 
by SGDT or SIDT, the upper 8 bits are stored as zeros. 

LGDT and LIDT appear in operating system software; they are not used 
in application programs. They are the only instructions that directly load 
a linear address (i.e., not a segment relative address) in 386 protected 
mode. 



LGS Load full pointer 

LSS LGS/LSS/LFS 386 and i486 only 

LFS 

|_p§ ODITSZAP 

LES 



Opcode Instruction Clocks Description 

486 386 286 86 

C5/r LDSr16,m16:16 6/12 7,pm=22 7,pm=21 16+EA Load DS:r1 6 witii pointer from memory 

C5/r LDS r32,m16:32 6/12 7,pm=22 Load DS:r32 with pointer from memory 

0FB2/r LSSr16,m16:16 6/12 7,pm=22 Load SS:r1 6 with pointer from memory 

0FB2/r LSSr32,m16:32 6/12 7,pm=22 Load SS:r32 with pointer from memory 

C4/r LESr16,m16:16 6/12 7,pm=22 7,pm=21 16+EA Load ES.tI 6 with pointer from memory 

C4/r LESr32,m16:32 6/12 7,pm=22 Load ES:r32 with pointer from memory 

0FB4/r LFSr16,m16:16 6/12 7,pm=25 Load FS:r1 6 with pointer from memory 

0FB4/r LFSr32,m16:32 6/12 7,pm=25 Load FS:r32 with pointer from memory 

0FB5/r LGSr16,m16:16 6/12 7,pm=25 Load GS:r1 6 with pointer from memory 

0FB5/r LGS r32,m1 6:32 6/12 7,pm=25 Load GS:r32 with pointer from memory 

These instructions read a full pointer from memory and store it in the se- 
lected segment register: register pair. The full pointer loads 16 bits into 
the segment register SS, DS, ES, FS, or GS. The other register loads 32 bits 
if the operand-size attribute is 32 bits, or loads 16 bits if the operand-size 
attribute is 16 bits. The other 16- or 32-bit register to be loaded is deter- 
mined by the rl6 or r32 register operand specified. 

When an assignment is made to one of the segment registers, the de-scrip- 
tor is also loaded into the segment register. The data for the register is ob- 
tained from the descriptor table entry for the selector given. 

A null selector (values 0000-0003) can be loaded into DS, ES, FS, or GS reg- 
isters without causing a protection exception. (Any subsequent reference 
to a segment whose corresponding segment register is loaded with a null 
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selector to address memory causes a #GP(0) exception. No memory refer- 
ence to the segment occurs.) 



LLDT Load local descriptor table register 

80286/386/486 protected mode only 



Opcode 


Instruction 




Clocks 




Description 


OF 00 12 


LLDTr/m16 


486 
11/11 


386 
20 


286 
17/19 


Load selector r/m16 into LDTR 



LLDT loads the local descriptor table register (LDTR). The word operand 
(memory or register) to LLDT should contain a selector to the global de- 
scriptor table (GDT). The GDT entry should be a local descriptor table. If 
so, then the LDTR is loaded from the entry. The descriptor registers DS, 
ES, SS, FS, GS, and CS are not affected. The LDT field in the task state seg- 
ment does not change. 

The selector operand can be 0; if so, the LDTR is marked invalid. All de- 
scriptor references (except by the LAR, VERR, VERW or LSL instructions) 
cause a #GP fault. 

LLDT is used in operating system software; it is not used in application 
programs. 



LMSW Load macliine status word 

80286/386/486 protected mode only 



Opcode 


Instruction 


Cloci<s 


Description 


OF 01 /6 


LMSWr/m16 


486 386 286 
13/13 10/13 3/6 


Load r/m 16 into machine status word 



LMSW loads the machine status word (part of CRO) from the source oper- 
and. This instruction can be used to switch to protected mode; if so, it 
must be followed by an intrasegment jump to flush the instruction queue. 
LMSW will not switch back to real address mode. 

LMSW is used only in operating system software. It is not used in applica- 
tion programs. 
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LOCK Assert LOCK# signal prefix 



Opcode Instruction 


Clocks 




Description 


486 
FO LOCK 1 


386 286 



86 
2 


Assert LOCK# signal for the next instruction 



The LOCK prefix causes the LOCK# signal of the CPU to be asserted dur- 
ing execution of the instruction that follows it. In a multiprocessor envi- 
ronment, this signal can be used to ensure that the CPU has exclusive use 
of any shared memory while LOCK# is asserted. The read-modify-write 
sequence typically used to implement test-and-set on the 386 is the BTS in- 
struction. 

On the 386 and i486, the LOCK prefix functions only with the following 
instructions: 

BT, BTS, BTR, BTC mem, reg/imm 

XCHG reg, mem 

XCHG mem, reg 

ADD, OR, ADC, SBB, mem, reg/imm 
AND, SUB, XOR 

NOT, NEC, INC, DEC mem 

An undefined opcode trap will be generated if a LOCK prefix is used 
with any instruction not listed above. 

XCHG always asserts LOCK # regardless of the presence or absence of the 
LOCK prefix. 

The integrity of the LOCK is not affected by the alignment of the memory 
field. Memory locking is observed for arbitrarily misaligned fields. 

Locked access is not assured if another CPU processor is executing an in- 
struction concurrently that has one of the following characteristics: 

■ Is not preceded by a LOCK prefix. 

■ Is not one of the instructions in the preceding list. 

■ Specifies a memory operand that does not exactly overlap the destina- 
tion operand. Locking is not guaranteed for partial overlap, even if one 
memory operand is wholly contained within another. 
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LODS 
LODSB 
LODSW 
LODSD 

Opcode Instruction 



Load string operand 
LODSD 386 and i486 only 



Clocks 



Description 







486 


386 


286 


86 


AC 


L0DSm18 


5 


5 


5 


12 


AD 


LODS m16 


5 


5 


5 


12 


AD 


LODS m32 


5 


5 






AC 


LODSB 


5 


5 


5 


12 


AD 


LODSW 


5 


5 


5 


12 


AD 


L0DSD5 


5 









Load byte [(E)SI] into AL 
Load word [(E)SI] into AX 
Load dword [(E)SI] into EAX 
Load byte DS:[(E)SI] into AL 
Load word DS:[(E)SI] into AX 
Load dword DS:[(E)SI] into EAX 



LODS loads the AL, AX, or EAX register with the memory byte, word, or 
doubleword at the location pointed to by the source-index register. After 
the transfer is made, the source-index register is automatically advanced. 
If the direction flag is (CLD was executed), the source index increments; 
if the direction flag is 1 (STD was executed), it decrements. The increment 
or decrement is 1 if a byte is loaded, 2 if a word is loaded, or 4 if a double- 
word is loaded. 

If the address-size attribute for this instruction is 16 bits, SI is used for the 
source-index register; otherwise the address-size attribute is 32 bits, and 
the ESI register is used. The address of the source data is determined 
solely by the contents of ESI/SI. Load the correct index value into SI 
before executing the LODS instruction. LODSB, LODSW, LODSD are syn- 
onyms for the byte, word, and doubleword LODS instructions. 

LODS can be preceded by the REP prefix; however, LODS is used more 
typically within a LOOP construct, because further processing of the data 
moved into EAX, AX, or AL is usually necessary. 



LOOP Loop control with CX counter 

LOOPcond Loop control with CX/ECX counter 
(386 and i486 only) 



Opcode Instruction 



Clocks 



Description 







486 


386 


286 


86 




E2cb 


LOOP rel8 


2,6 


11+m 


8,noj=4 


17,noj=5 


DEC Count; jump short if Count 


Elcb 


LOOPE rel8 


9,6 


11+m 


8,noj=4 


18,noj=6 


DEC Count; jump short if Count and ZF=1 


Elcb 


LOOPZ rel8 


9,6 


11+m 


8,noj=4 


18,noj=6 


DEC Count; jump short if Count and ZF=1 


EOcb 


LOOPNE rel8 


9,6 


11+m 


8,noj=4 


19,noj=5 


DEC Count; jump short if Count and ZF=0 


EOcb 


LOOPNZ rel8 


9,6 


11+m 


8,noj=4 


19,noj=5 


DEC Count; jump short if Count and ZF=0 
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LOOP decrements the count register without changing any of the flags. 
Conditions are then checked for the form of LOOP being used. If the con- 
ditions are met, a short jump is made to the label given by the operand to 
LOOP. If the address-size attribute is 16 bits, the CX register is used as the 
count register; otherwise the ECX register is used (386 only). The operand 
of LOOP must be in the range from 128 (decimal) bytes before the instruc- 
tion to 127 bytes ahead of the instruction. 

The LOOP instructions provide iteration control and combine loop index 
management with conditional branching. Use the LOOP instruction by 
loading an unsigned iteration count into the count register, then code the 
LOOP at the end of a series of instructions to be iterated. The destination 
of LOOP is a label that points to the beginning of the iteration. 



LSL Load segment limit 

80286/386/486 protected mode only 



Opcode Instruction Clocks Description 

486 386 286 

0F03/r LSLr16,r/m16 10/10 pm=20/21 14/16 Load: r16^segment limit, selector r/m1 6 

(byte granular) 
0F03/r LSLr32,r/m32 10/10 pm=20/21 Load: r32<-segment limit, segment limit, 

selector r/m32 (byte granular) 
0F03/r LSLr16,r/m16 10/10 pm=25/26 14/16 Load: r16<-segment limit, segment limit, 

selector r/m16 (page granular) 
0F03/r LSLr32,r/m32 10/10 pm=26/26 Load: r32<-segment limit selector r/m32 
(page granular) 

The LSL instruction loads a register with an unscrambled segment limit, 
and sets ZF to 1, provided that the source selector is visible at the CPL 
weakened by RPL, and that the descriptor is a type accepted by LSL. Oth- 
erwise, ZF is cleared to 0, and the destination register is unchanged. The 
segment limit is loaded as a byte granular value. If the descriptor has a 
page granular segment limit, LSL will translate it to a byte limit before 
loading it in the destination register (shift left 12 the 20-bit "raw" limit 
from descriptor, then OR with OOOOOFFFH). 

The 32-bit forms of this instruction store the 32-bit byte granular limit in 
the 16-bit destination register. 

Code and data segment descriptors are valid for LSL. 
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LTR 



Load task register 

80286/386/486 protected mode only 



Opcode 


Instruction 




Clocks 




Description 


OF 00 /3 


LTR r/m16 


486 
20/20 


386 
pm=23/27 


286 

17/19 


Load EA word into task register 



LTR loads the task register from the source register or memory location 
specified by the operand. The loaded task state segment is marked busy. 
A task switch does not occur. 

LTR is used only in operating system software; it is not used in applica- 
tion programs. 



MOV 



Move data 





D 


I T 


S 


Z A P C 


Opcode 


Instruction 


Clocks 






Description 




486 


386 


286 


86 




88 /r 


MOV r/ni8,r8 1 


2/2 


2/3 


2/9+EA 


Move byte register into r/m byte 


89 /r 


MOVr/m16,r16 1 


2/2 


2/3 


2/9+EA 


Move word register into r/m word 


89 /r 


MOV r/m32,r32 1 


2/2 






Move dword register to r/m dword 


8A/r 


MOV r8,r/m8 1 


2/4 


2/5 


2/8+EA 


Move r/m byte into byte register 


8B/r 


MOVr16,r/m16 1 


2/4 


2/5 


2/8+EA 


Move r/m word into word register 


8B/r 


MOV r32,r/m32 1 


2/4 






Move r/m dword into dword register 


8C/r 


M0Vr/m16,Sreg 3/3 


2/2 


2/3 


2/9+EA 


Move segment register to r/m register 


8D/r 


M0VSreg,r/m16 3/9 


2/5,pm= 
1/198 


2/5,pm= 
17/19 


= 2/8+EA 


Move r/m word to segment register 


AO 


MOVAL,moffs8 1 


4 


5 


10 


Move byte at (seg:offset) to AX 


A1 


MOVAX,moffs16 1 


4 


5 


10 


Move word at (seg:offset) to AX 


A1 


MOV EAX,moffs32 1 


4 






Move dword at (seg:offset) to EAX 


A2 


MOV moffs8,AL 1 


4 


3 


10 


Move AL to (seg:offset) 


A3 


MOVmoffs16,AX 1 


2 


3 


10 


Move AX to (seg:offset) 


A3 


MOV moffs32,EAX 1 


2 






Move EAX to (seg:offset) 


BO+rb 


MOV reg8,imm8 1 


2 


2 


4 


Move immediate byte to register 


B8+rw 


MOVreg16,imm16 1 


2 


2 


4 


Move immediate word to register 


B8+rd 


MOV reg32,imm32 1 


2 






Move immediate dword to register 


C6 


MOV r/m8,imm8 1 


2/2 


2/3 


4/10+EA 


Move immediate byte to r/m byte 


C7 


MOVr/m16,imm16 1 


2/2 


2/3 


4/10+EA 


Move immediate word to r/m word 


C7 


MOV r/m32,imm32 1 


2/2 






Move immediate dword to r/m dword 



MOV copies the second operand to the first operand. 

If the destination operand is a segment register (DS, ES, SS, etc.), then 
data from a descriptor is also loaded into the register. The data for the reg- 
ister is obtained from the descriptor table entry for the selector given. A 
null selector (values 0000-0003) can be loaded into DS and ES registers 
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without causing an exception; however, use of DS or ES causes a #GP(0), 
and no memory reference occurs. 

A MOV into SS inhibits all interrupts until after the execution of the next 
instruction (which is presumably a MOV into eSP). 



MOV 



Move to/from special registers 
386 and i486 only 



Opcode Instruction 



Clocks 



Description 







486 


386 


OF 22 /r 


MOV,CR0,r32 


16 




OF 20 /r 


MOV r32,CR0/CR2/CR3 


4 


6 


OF 22 /r 


MOV CR0/CR2/CR3,r32 


4 


10/4/5 


OF 21 /r 


MOV r32,DR0 - 3 


10 


22 


OF 21 /r 


MOV r32,DR6/DR7 


10 


14 


OF 23 /r 


MOV DRO -3,r32 


11 


22 


OF 23 /r 


MOV DR6/DR7,r32 


11 


16 


OF 24 /r 


MOV r32,TR6/TR7 


4 


12 


OF 26 /r 


MOVTR6/TR7,r32 


4 


12 


OF 24 /r 


MOV r32,TR3 




3 



Move (register) to (control register) 
Move (control register) to (register) 

Move (debug register) to (register) 
Move (debug register) to (register) 
Move (register) to (debug register) 
Move (register) to (debug register) 
Move (test register) to (register) 
Move (register) to (test register) 
Move (registers) to (test register3) 



These forms of MOV store or load the following special registers in or 
from a general-purpose register: 

■ Control Registers CRO, CR2, and CR3 

■ Debug Registers DRO, DRl, DR2, DR3, DR6, and DR7 

■ Test Registers TR3, TR4, TR5, TR6, and TR7 

32-bit operands are always used with these instructions, regardless of the 
operand-size attribute. 



MOVS 
MOVSB 
MOVSW 
MOVSD 



Move data from string to string 
MOVSD 386 and i486 only 



Opcode Instruction 



Clocks 



Description 



A4 
A5 
A5 
A4 
A5 
A5 



MOVS m8,m8 

MOVSm16,m16 

MOVm32,m32 

MOVSB 

MOVSW 

MOVSD 



486 

7 

7 

7 

7 

7 

7 



386 

7 

7 

7 

7 

7 

7 



286 
5 



Move byte [(E)SI] to ES:[(E)DI] 
Move word [(E)SI] to ES:[(E)Di] 
Move dword [(E)SI] to ES:[(E)DI] 
Move byte DS:[(E)S1] to ES:[(E)DI] 
Move word DS:[(E)SI] to ES:[(E)DI] 
Move dword DS:[(E)SI] to ES:[(E)DI] 
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_J 



_J 



^J 



MOVS copies the byte or word at [(E)SI] to the byte or word at ES: 
[(E)DI]. The destination operand must be addressable from the ES regis- 
ter; no segment override is possible for the destination. A segment over- 
ride can be used for the source operand; the default is DS. 

The addresses of the source and destination are determined solely by the 
contents of (E)SI and (E)DI. Load the correct index values into (E)SI and 
(E)DI before executing the MOVS instruction. MOVSB, MOVSW, and 
MOVSD are synonyms for the byte, word, and doubleword MOVS 
instructions. 



" J After the data is moved, both (E)SI and (E)DI are advanced automatically. 

~S If the direction flag is (CLD was executed), the registers are incre- 

mented; if the direction flag is 1 (STD was executed), the registers are 

~ decremented. The registers are incremented or decremented by 1 if a byte 

was moved, 2 if a word was moved, or 4 if a doubleword was moved. 

_J' MOVS can be preceded by the REP prefix for block movement of CX 

- ^ bytes or words. Refer to the REP instruction for details of this operation. 



MOVSX Move with sign-extend 

386 and i486 only 



Opcode 


Instruction 


Clocks 


Description 






486 386 




OFBE/r 


MOVSX r16,r/m8 


3/3 3/6 


Move byte to word with sign extend 


OF BE /r 


MOVSX r32,r/m8 


3/3 3/6 


Move byte to dword 


OF BE /r 


MOVSX r32,r/m16 


3/3 3/6 


Move word to dword 



MOVSX reads the contents of the effective address or register as a byte or 
a word, sign-extends the value to the operand-size attribute of the instruc- 
tion (16 or 32 bits), and stores the result in the destination register. 



MOVZX IVIove witin zero-extend 

386 and i486 only 



Opcode 


Instruction 


Clocks 


Description 






486 386 




OF B6 /r 


MOVZX r16,r/m8 


3/3 3/6 


Move byte to word with zero extend 


OF B6 /r 


MOVZX r32,r/m8 


3/3 3/6 


Move byte to dword 


OF B7 /r 


MOVZX r32,r/m16 


3/3 3/6 


Move word to dword 
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MOVZX reads the contents of the effective address or register as a byte or 
a word, zero extends the value to the operand-size attribute of the instruc- 
tion (16 or 32 bits), and stores the result in the destination register. 



MUL Unsigned multiplication of AL or AX 



Opcode Instruction Clocks Description 

486 386 286 86 

F6/4 MULr/m8 13/18,13/18 9-14/12-17 13/16 70-77/76-83+ E A Unsigned multiply (AX 

[(AL 8 r/m byte) 
F7/4 MULr/m16 13/26,13/26 9-22/12-25 21/24 11 8-1 13/1 24-1 39+EA (DX:AX[AX * r/m word) 
F7/4 MULr/m32 13/42,13/42 9-38/12-41 Unsigned multiply 

(EDX: EAX[EAX * r/m 
dword) 

MUL performs unsigned multiplication. Its actions depend on the size of 
its operand, as follows: 

■ A byte operand is multiplied by AL; the result is left in AX. The carry 
and overflow flags are set to if AH is 0; otherwise, they are set to L 

■ A word operand is multiplied by AX; the result is left in DX: AX. DX 
contains the high-order 16 bits of the product. The carry and overflow 
flags are set to if DX is 0; otherwise, they are set to 1. 

■ A doubleword operand is multiplied by EAX and the result is left in 
EDX:EAX. EDX contains the high-order 32 bits of the product. The 
carry and overflow flags are set to if EDX is 0; otherwise, they are set 
to 1 (386 only). 



NEG Two's complement negation 



Opcode 


Instruction 




Clocks 




Description 






486 


386 286 


86 




F6/3 


NEG r/m8 


1/3 


2/6 2/7 


3/16+EA 


Two's complement negate r/m byte 


F7/3 


NEG r/m16 


1/3 


2/6 2/7 


3/16+EA 


Two's complement negate r/m word 


F7/3 


NEG r/m32 


1/3 


2/6 




Two's complement negate r/m dword 



NEG replaces the value of a register or memory operand with its two's 
complement. The operand is subtracted from zero, and the result is 
placed in the operand. 

The carry flag is set to 1, unless the operand is zero, in which case the 
carry flag is cleared to 0. 
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NOP 



No operation 



Opcode 


Instruction 




Clocks 






Description 


90 


NOP 


486 
1 


386 
3 


286 
3 


86 
3 


No operation 



NOP performs no operation. NOP is a one-byte instruction that takes up 
space but affects none of the machine context except (E)IP. 

NOP is an alias mnemonic for the XCHG (E)AX, (E)AX instruction. 



NOT 



One's complement negation 



Opcode 


Instruction 




Clocks 




Description 






486 


386 286 


86 




F6/2 


NOT r/m8 


1/3 


2/6 2/7 


3/16+EA 


Reverse each bit of r/m byte 


F7/2 


N0Tr/m16 


1/3 


2/6 2/7 


3/16+EA 


Reverse each bit of r/m word 


F7/2 


NOT r/m32 


1/3 


2/6 2/7 




Reverse each bit of r/m dword 



NOT inverts the operand; every 1 becomes a 0, and vice versa. 



.J 



OR 



Logical Inclusive OR 








D 


I T 


S 


Z A 


P C 











* 


* ? 


* 


Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




OCib 


OR AL,imm8 


1 


2 


3 


4 


OR immediate byte to AL 


ODiw 


0RAX,imm16 


1 


2 


3 


4 


OR immediate word to AX 


ODid 


OR EAX,imm32 


1 


2 






OR immediate dword to EAX 


80 /I ib 


OR r/m8,imm8 


1/3 


2/7 


3/7 


4/17+EA 


OR immediate byte to r/m byte 


81 /I iw 


ORr/m16,imm16 


1/3 


2/7 


3/7 


4/17+EA 


OR immediate word to r/m word 


81 /I id 


OR r/m32,imm32 


1/3 


2/7 






OR immediate dword to r/m dword 


83 /1 ib 


OR r/m16,imm8 


1/3 


2/7 






OR sign-extended immediate byte 
with r/m word 


83 /I ib 


OR r/m32,imm8 


1/3 


2/7 






OR sign-extended immediate byte 
with r/m dword 


08 /r 


OR r/m8,r8 


1/3 


2/6 


2/7 


3/16+EA 


OR byte register to r/m byte 


09 /r 


ORr/m16,r16 


1/3 


2/6 


2/7 


3/16+EA 


OR word register to r/m word 


09 /r 


OR r/m32,r32 


1/3 


2/6 






OR dword register to r/m dword 


OA/r 


OR r8,r/m8 


1/2 


2/7 


2/7 


3/9+EA 


OR byte register to r/m byte 


OB/r 


OR r16,r/m16 


1/2 


2/7 


2/7 


3/9+EA 


OR word register to r/m word 


OB/r 


OR r32,r/m32 


1/2 


2/7 






OR dword register to r/m word 
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OR computes the inclusive OR of its two operands and places the result 
in the first operand. Each bit of the result is if both corresponding bits of 
the operands are 0; otherwise, each bit is 1. 



OUT 



Output to port 







GDI 


T 


S Z A P 


C 




Opcode 


Instruction 






Clocks 






Description 






486 




386 


286 


86 




E6ib 


OUT imm8,AL 


16,pm=11*/3r 


*,vm=29 


10,pm=4*/24" 


3 


10 


Output byte AL to 
immediate port number 


E7ib 


OUT immS.AX 


16,pm=ir/31",vm=29 


10,pm=4724" 


3 


10 


Output word AX to 
















immediate port number 


E7ib 


OUT 
immS.EAX 


16,pm=11*/31* 


*,vm=29 


10,pm=4V25" 






Output dword EAX to 
immediate port number 


EE 


OUT DX,AL 


16,pm=11*/31* 


',vm=29 


11,pm=5*/25" 


3 


8 


Output byte AL to port 
number in DX 


EF 


OUT DX,AX 


16,pm=11*/31* 


*,vm=29 


11,pm=5*/25" 


3 


8 


Output word AX to 
port number in DX 


EF 


OUT DX,EAX 


16,pm=11*/31* 


*,vm=29 


11,pm=5*/25" 






Output dword EAX to 
port number in DX 


* If CPL < lOPL 














" If CPL 


> lOPL or if in virtual 8086 mode 













OUT transfers a data byte or data word from the register (AL, AX, or 
EAX) given as the second operand to the output port numbered by the 
first operand. Output to any port from to 65535 is performed by placing 
the port number in the DX register and then using an OUT instruction 
with DX as the first operand. If the instruction contains an eight-bit port 
ID, that value is zero-extended to 16 bits. 



OUTS 
OUTSB 
OUTSW 
OUTSD 



Output string to port 

OUTS/OUTSB/OUTSW 80186/286/386/486 only 

OUTSD 386 and i486 only 



Opcode Instruction 



Clocks 



Description 



486 386 286 

6E 0UTSDX,r/m8 17,pm=10*/32**,vm=30 14,pm=8V28** 5 

6F 0UTSDX,r/m16 17,pm=10732",vm=30 14,pm=8V28" 5 

6F OUTSDX,r/m32 17,pm=10V32",vm=30 14,pm=8V28" 

6E OUTSB 17,pm=10*/32",vm=30 14,pm=8728" 5 

6F OUTSW 17,pm=10732",vm=30 14,pm=8V28" 5 



Output byte [(E)SI] to port 

inDX 

Output word [(E)SI] to port 

inDX 

Output dword [(E)SI] to 

port in DX 

Output byte DS:[(E)SI] to 

port in DX 

Output word DS:[(E)SI] to 

port number in DX 
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Opcode Instruction 


Clocks 




Description 


6F OUTSD 


486 386 

1 7,pm=1 0*/32",vm=30 1 4,pm=8V28" 


286 


Output dword DS:[(E)SI] to 
port in DX 



„J 



OUTS transfers data from the memory byte, word, or doubleword at the 

- ' source-index register to the output port addressed by the DX register. If 
'") the address-size attribute for this instruction is 16 bits, SI is used for the 
'-. source-index register; otherwise, the address-size attribute is 32 bits, and 
--' ESI is used for the source-index register. 

- , OUTS does not allow specification of the port number as an immediate 
~ value. The port must be addressed through the DX register value. Load 
,J the correct value into DX before executing the OUTS instruction. 

", The address of the source data is determined by the contents of source- 

— ' index register. Load the correct index value into SI or ESI before executing 

) the OUTS instruction. 

After the transfer, source-index register is advanced automatically. If the 
.J direction flag is (CLD was executed), the source-index register is incre- 

■ , mented; if the direction flag is 1 (STD was executed), it is decremented. 

The amount of the increment or decrement is 1 if a byte is output, 2 if a 
_) word is output, or 4 if a doubleword is output. 

OUTSB, OUTSW, and OUTSD are synonyms for the byte, word, and 
•~^ doubleword OUTS instructions. OUTS can be preceded by the REP prefix 

2; for block output of CX bytes or words. Refer to the REP instruction for de- 

tails on this operation. 



POP Pop a word from the stack 



ODITSZAPC 



Opcode Instruction Clocks Description 

Pop top of stack into memory word 
■) 8F/0 POPm32 6 5 Pop top of stack into memory dword 

58+n« P0Pr16 4 4 5 8 Pop top of stack into word register 

■J 58+rd POPr32 4 4 Pop top of stack into dword register 







486 


386 


286 


86 


8F/0 


P0Pm16 


6 


5 


5 


17+EA 


8F/0 


POP m32 


6 


5 






58+n« 


P0Pr16 


4 


4 


5 


8 


58+rd 


POP r32 


4 


4 






1F 


POPDS 


3 


7,pm=21 


5,pm=20 


8 


07 


POPES 


3 


7,pm=21 


5,pm=20 


8 


17 


POPSS 


3 


7,pm=21 


5,pm=20 


8 


0FA1 


POPFS 


3 


7,pm=21 






0FA9 


POPGS 


3 


7,pm=21 







Pop top of stack into DS 
Pop top of stack into ES 
Pop top of stack into SS 
Pop top of stack into FS 
Pop top of stack into GS 



POP replaces the previous contents of the memory, the register, or the seg- 
ment register operand with the word on the top of the stack, addressed 
by SS:SP (address-size attribute of 16 bits) or SS:ESP (address-size attri- 
bute of 32 bits). The stack pointer SP is incremented by 2 for an operand- 
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size of 16 bits or by 4 for an operand-size of 32 bits. It then points to the 
new top of stack. 

POP CS is not an instruction. Popping from the stack into the CS register 
is accomplished with a RET instruction. 

If the destination operand is a segment register (DS, ES, FS, GS, or SS), the 
value popped must be a selector. In protected mode, loading the selector 
initiates automatic loading of the descriptor information associated with 
that selector into the hidden part of the segment register; loading also initi- 
ates vahdation of both the selector and the descriptor information. 

A null value (0000-0003) may be popped into the DS, ES, FS, or GS regis- 
ter without causing a protection exception. An attempt to reference a seg- 
ment whose corresponding segment register is loaded with a null value 
causes a #GP(0) exception. No memory reference occurs. The saved value 
of the segment register is null. 

A POP SS instruction inhibits all interrupts, including NMI, until after exe- 
cution of the next instruction. This allows sequential execution of POP SS 
and POP ESP instructions without danger of having an invalid stack dur- 
ing an interrupt. However, use of the LSS instruction is the preferred 
method of loading the SS and eSP registers. 

Note: Turbo Assembler extends the syntax of the POP instruction to facili- 
tate popping multiple items in sequence. The items popped can include 
any legal POP value, including registers, immediate values, and memory 
locations. This feature does not actually affect the code generated. 



POPA Pop all general registers 

POPAD POPA 80186/286/386/486 only 

POPAD 386 and I486 only 



Opcode Instruction Clocks Description 







486 


386 


286 




61 


POPA 


9 


24 


19 


PopDI 


61 


POPAD 


9 


24 




Pop EDI 



POPA pops the eight 16-bit general registers. However, the SP value is dis- 
carded instead of loaded into SP. POPA reverses a previous PUSHA, re- 
storing the general registers to their values before PUSHA was executed. 
The first register popped is DI. 

POPAD pops the eight 32-bit general registers. The ESP value is discarded 
instead of loaded into ESP. POPAD reverses the previous PUSHAD, re- 
storing the general registers to their values before PUSHAD was executed. 
The first register popped is EDI. 
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:j 
1) 

._) 

1j 
Zj 
Cj 
1j 
Ij 
C3 
iJ 
Z) 
Z) 
__j 

•Zj 
Z) 
1) 
13 

:3 

ZL) 
CJ 

IJ 

Z) 

■-J 

Z3 

1j 
C.j 

1) 

:_) 



3 

13 
"■.) 

Z) 
13 



POPF 
POPFD 



Opcode Instruction 



Pop from stock into FLAGS or EFLAGS register 
POPFD 386 and i486 oniy 



Clocks 



Description 







486 386 


286 


86 




9D 


POPF 


9,pm=6 5 


5 


8 


Pop top of stack FLAGS 


9D 


POPFD 


9,pm=6 5 






Pop top of stack into EFLAGS 



POPF/POPFD pops the word or doubleword on the top of the stack and 
stores the value in the flags register. If the operand-size attribute of the in- 
struction is 16 bits, then a word is popped and the value is stored in 
FLAGS. If the operand-size attribute is 32 bits, then a doubleword is 
popped and the value is stored in EFLAGS. 

Note that bits 16 and 17 of EFLAGS, called VM and RF, respectively, are 
not affected by POPF or POPFD. 

The I/O privilege level is altered only when executing at privilege level 0. 
The interrupt flag is altered only when executing at a level at least as priv- 
ileged as the I/O privilege level. (Real-address mode is equivalent to privi- 
lege level 0.) If a POPF instruction is executed with insufficient privilege, 
an exception does not occur, but the privileged bits do not change. 



PUSH 



Opcode Instruction 



Pusti operand onto tine stacl< 



Clocks 



Description 



FF/6 

FF/6 

50+ /r 

50+ /r 

6A 

68 

68 

OE 

16 

IE 

06 

OFAO 

OF AS 



PUSHm16 
PUSH m32 
PUSH r16 
PUSH r32 
PUSH imm8 
PUSH imm16 
PUSH imm32 
PUSH CS 
PUSH SS 
PUSH DS 
PUSH ES 
PUSH FS 
PUSH GS 



486 
4 



386 

5 

5 

2 

2 

2 3 

2 

2 

2 

2 

2 

2 

2 

2 



286 
5 



1 6+EA Push memory word 
Push memory dword 
Push register word 
Push register dword 
Push immediate byte 
Push immediate word 
Push immediate dword 
Push CS 
Push SS 
Push DS 
Push ES 
Push FS 
Push GS 



11 



PUSH decrements the stack pointer by 2 if the operand-size attribute of 
the instruction is 16 bits; otherwise, it decrements the stack pointer by 4. 
PUSH then places the operand on the new top of stack, which is pointed 
to by the stack pointer. 
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The 386 PUSH eSP instruction pushes the value of the eSP as it existed 
before the instruction. The 80286 PUSH SP instruction also pushes the 
value of SP as it existed before the instruction. This differs from the 8086, 
where PUSH SP pushes the new value (decremented by 2). 

Note: Turbo Assembler extends the syntax of the PUSH instruction to fa- 
cilitate pushing multiple items in sequence. The items pushed can include 
any legal PUSH value, including registers, immediate values, and 
memory locations. This feature does not actually affect the code gener- 
ated. In addition, the PUSH instruction allows constant arguments even 
when generating code for the 8086 processor. Such instructions are re- 
placed in the object code by a 10-byte sequence that simulates the 
80186/286/386 PUSH immediate value instruction. 



PUSHA 
PUSHAD 



Push all general registers 
PUSHA 80186/286/386/486 only 
PUSHAD 386 andi486 only 



Opcode 


Instruction 




Clocks 


Description 


60 
60 


PUSHA 
PUSHAD 


486 

11 

11 


386 286 
18 17 
18 


Push AX,CX,DX,BX,original SP.BP.SI 
Push EAX,ECX,EDX,EBX 



PUSHA and PUSHAD save the 16-bit or 32-bit general registers, respec- 
tively, on the stack. PUSHA decrements the stack pointer (SP) by 16 to 
hold the eight word values. PUSHAD decrements the stack pointer (ESP) 
by 32 to hold the eight double word values. Because the registers are 
pushed onto the stack in the order in which they were given, they appear 
in the 16 or 32 new stack bytes in reverse order. The last register pushed 
is DI or EDI. 



PUSHF 
PUSHFD 



Push flags register onto the stack 
PUSHFD 386 andi486 only 



Instruction 



Clocks 



Description 







486 


386 


286 


86 




9C 


PUSHF 


4,pm=3 


4 


3 


10 


Push FLAGS 


9C 


PUSHFD 


4,pm=3 


4 






Push EFLAGS 



PUSHF decrements the stack pointer by 2 and copies the FLAGS register 
to the new top of stack; PUSHFD decrements the stack pointer by 4, and 
the 386 EFLAGS register is copied to the new top of stack which is 
pointed to by SS:eSP. 
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I. J 


RCL 
RCR 


Rotate 
























Z'j 


ROL 


c 

* 


) D 


I T 


S 


ZAP 


C 
* 


1 .) 


ROR 














• — ^' 


Opcode 


Instruction 




Clocl<s 






Description 


^j 






486 


386 


286 


86 




I) 


DO/2 


RCL r/m8,1 


3/4 


9/10 


2/7 


2/15+EA 


Rotate 9 bits (CF,r/m byte) 














left once 


C ') 


D2/2 


RCL r/m8,CL 


8-30/9-31 


9/10 


5/8 


8-I-4 per bit/(20-f4 


Rotate 9 bits (CF,r/m byte) 














per bit)+EA 


left CL times 


:_) 


CO /2 ib 


RCL r/m8,imm8 


8-30/9-31 


9/10 


5/8 




Rotate 9 bits (CF,r/m byte) 
















left imm8 times 


Lj 


D1/2 


RCL r/m 16,1 


3/4 


9/10 


2/7 


2/15+EA 


Rotate 17 bits (CF,r/m 


13 














word) left once 


D3/2 


RCLr/m16,CL 


8-30/9-31 


9/10 


5/8 


8+4 per bit/(20+4 


Rotate 17 bits (CF, r/m 


13 












per bit)+EA 


word) left CL times 


... ^ 

- — / 


C1 12 ib 


RCL r/m 16, 


8-30/9-31 


9/10 


5/8 




Rotate 17 bits (CF,r/m 




imm8 










word)) left imm8 times 


iJ 


D1/2 


RCL r/m32,1 


3/4 


9/10 






Rotate 33 bits (CF,r/m 














dword) left once 




D3/2 


RCL r/m32,CL 


8-30/9-31 


9/10 






Rotate 33 bits (CF,r/m 
dword) left CL times 


. ) 


C1 12 ib 


RCL r/m32, 


8-30/9-31 


9/10 






Rotate 33 bits (CF,r/m 


113 




imm8 










dword) left, imm8 times 


DO/3 


RCR r/m8,1 


3/4 


9/10 


2/7 


2/15+EA 


Rotate 9 bits (CF,r/m byte) 


dj 














right once 




D2/3 


RCR r/m8,CL 


8-30/9-31 


9/10 


5/8 


8+4 per bit/(20+4 


Rotate 9 bits (CF,r/m byte) 


d) 












per bit)+EA 


right CL times 


13 


CO /3 ib 


RCR r/m8,imm8 


8-30/9-31 


9/10 


5/8 




Rotate 9 bits (CF,r/m byte) 














right imm8 times 


3 


D1/3 


RCR r/m16,1 


3/4 


9/10 


2/7 


2/15+EA 


Rotate 17 bits (CF,r/m 
















word) right once 


3 


D3/3 


RCR r/m16,CL 


8-30/9-31 


9/10 


5/8 


8+4 per bit/(20+4 


Rotate 17 bits (CF,r/m 


IJ 












per bit)+EA 


word) right CL times 


C1 /3 ib 


RCRr/m16, 


8-30/9-31 


9/10 


5/8 




Rotate 17 bits (CF,r/m 


,— .- 




immS 










word) right imm8 times 




D1/3 


RCR r/m32,1 


3/4 


9/10 






Rotate 33 bits (CF,r/m 


3 














dword) right once 


,-, 


D3/3 


RCR r/m32,CL 


8-30/9-31 


9/10 






Rotate 33 bits (CF,r/m 


■— -"^ 














dword) right CL times 


Ij 


C1 /3 ib 


RCR r/m32, 
imm8 


8-30/9-31 


9/10 






Rotate 33 bits (CF,r/m 
dword) right imm8 times 


3' 


DO/O 


ROL r/m8,1 


3/4 


3/7 


2/7 


2/15+EA 


Rotate 8 bits r/m byte left 

nnrp 


3 


D2/0 


ROL r/m8,CL 


3/4 


3/7 


5/8 


8+4 per bit/(20+4 


Rotate 8 bits r/m byte left 


3 












per bit)+EA 


CL times 




CO /O ib 


ROL r/m8, imm8 


2/4 


3/7 


5/8 




Rotate 8 bits r/m byte left 


3 














imm8 times 


3 


D1/0 


R0Lr/m16,1 


3/4 


3/7 


2/7 


2/15+EA 


Rotate 16 bits r/m word left 
once 


1^3 


D3/0 


R0Lr/m16,CL 


3/4 


3/7 


5/8 


8+4 per bit/(20+4 


Rotate 16 bits r/m word left 














per bit)+EA 


CL times 


3 


C1 /O ib 


ROL r/m 16, 


2/4 


3/7 


5/8 




Rotate 16 bit r/m word left 


^^ 




imm8 










imm8 times 



u 
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Opcode 


Instruction 




Clocks 






Description 


r 






486 


386 


286 


86 




r 


D1/0 


R0Lr/m32,1 


3/4 


3/7 






Rotate 32 bits r/m dword left 
once 




D3/0 


ROL r/m32,OL 


3/4 


3/7 






Rotate 32 bits r/m dword left 
CL times 


r 


01 /O ib 


ROLr/m32, 
imm8 


2/4 


3/7 






Rotate 32 bits r/m dword left 
imm8 times 




DO/1 


ROR r/m8,1 


3/4 


3/7 


2/7 


2/15+EA 


Rotate 8 bits r/m byte right 
once 




D2/1 


ROR r/m8,0L 


3/4 


3/7 


5/8 


8+4 per bit/(20+4 
per bit)+EA 


Rotate 8 bits r/m byte right 
CL times 




CO /I ib 


ROR r/m8, 
imm8 


2/4 


3/7 


5/8 




Rotate 8 bits r/m word right 
imm8 times 




D1/1 


R0Rr/m16,1 


3/4 


3/7 


2/7 


2/15+EA 


Rotate 16 bits r/m word 
right once 




D3/1 


R0Rr/m16,CL 


3/4 


3/7 


5/8 


8+4 per bit/(20+4 
per bit)+EA 


Rotate 16 bits r/m word 
right CL times 




01 /I ib 


R0Rr/m16, 
imm8 


2/4 


3/7 


5/8 




Rotate 16 bit r/m word right 
imm8 times 




D1/1 


ROR r/m32,1 


3/4 


3/7 






Rotate 32 bits r/m dword 
right once 




D3/1 


ROR r/m32,CL 


3/4 


3/7 






Rotate 32 bits r/m dword 
right CL times 




01 /I ib 


ROR r/m32, 
imm8 


2/4 


3/7 






Rotate 32 bits r/m dword 
right imm8 times 


' 


Add 1 clock to the times shown for each rotate made (80286 


jnly). 







Each rotate instruction shifts the bits of the register or memory operand 
given. The left rotate instructions shift all the bits upward, except for the 
top bit, which is returned to the bottom. The right rotate instructions do 
the reverse: The bits shift downward until the bottom bit arrives at the top. 

For the RCL and RCR instructions, the carry flag is part of the rotated 
quantity. RCL shifts the carry flag into the bottom bit and shifts the top 
bit into the carry flag; RCR shifts the carry flag into the top bit and shifts 
the bottom bit into the carry flag. For the ROL and ROR instructions, the 
original value of the carry flag is not a part of the result, but the carry flag 
receives a copy of the bit that was shifted from one end to the other. 

The rotate is repeated the number of times indicated by the second oper- 
and, which is either an immediate number or the contents of the CL regis- 
ter. To reduce the maximum instruction execution time, the 80286/386 
does not allow rotation counts greater than 31. If a rotation count greater 
than 31 is attempted, only the bottom five bits of the rotation are used. 
The 8086 does not mask rotation counts. The 386 in virtual 8086 mode 
does mask rotation counts. 

The overflow flag is defined only for the single-rotate forms of the instruc- 
tions (second operand = 1). It is undefined in all other cases. For left 
shifts /rotates, the CF bit after the shift is XORed with the high order re- 
sult bit. For right shifts /rotates, the high-order two bits of the result are 
XORed to get OF. 
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REP 
REPE 




Repeat following string operation 
















13 


REPZ 




D I 


T S Z 

it 


A 


P C 


^J 


REPNE 












■^j 


REPNZ 












^ 
















i) 


Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




'Sj 


F3 6C 


REP INS 


16+8(E)CX, 


13+6*(E)CX, 


5+4*CX 




Input (E)CX bytes from 


'^J 




r/m8,DX 


pm=10+8(E)CX*V 


pm=7+6*(E)CX/ 






port DX into ES:[(E)DI] 






30+8(E)CX*2,VM= 


27+6*1 *(E)CX*2 








^j 






29+8(E)CX 












F3 6D 


REP INS 


16+8(E)CX, 


13+6*(E)CX, 


5+4*CX 




Input (E)CX words from 


^ / 




r/m16,DX 


pm=10+8(E)CX*V 


pm=7+6*(E)CX/ 






port DX into ES:[(E)DI] 


"" '\ 






30+8(E)CX*2,VM= 


27+6*1 *(E)CX*2 














29+8(E)CX 










^ J 


F3 6D 


REP INS 


16+8(E)CX, 


13+6*(E)CX, 






Input (E)CX dwords 






r/m32,DX 


pm=10+8(E)CX*V 


pm=7+6*(E)CX/ 






from port DX into 


Sj 






30+8(E)CX*2,VM= 
29+8(E)CX 


27+6*1 *(E)CX*2 






ES:[(E)DI] 


> J 


F3A4 


REP MOVS 


5*3,13M2+3(E) 


5+4*(E)CX 


5+4*CX 


9+17*CX 


Move (E)CX bytes from 


- . 




m8,m8 


CX*5 








[(E)SI]toES:[(E)DI] 


'■U 


F3A5 


REP MOVS 
m16,m16 


5*3,13*M2+3(E) 

CX*5 


5+4*(E)CX 


5+4*CX 


9+17*CX 


Move (E)CX words from 
[(E)SI]toES:[(E)DI] 




F3A5 


REP MOVS 


5*3,1 3*M2+3(E) 


5+4*(E)CX 






Move (E)CX dwords 


^j 




m32,m32 


CX*5 








from [(E)SI] to ES:[(E)Di] 


Z) 


F3 6E 


REP OUTS 


17+5(E)CX, 


5+12*(E)CX, 


5+4*CX 




Output (E)CX bytes 




DX,r/m8 


pm=11+5(E)CX*V 


pm=6+5*(E) 






from [(E)SI] to port DX 








31+5(E)CX*2 


CX/26+5*i*(E) 

CX*2 








Zj 


F3 6F 


REP OUTS 


17+5(E)CX, 


5+12*(E)CX, 


5+4*CX 




Output (E)CX words 


" \ 




DX,r/m16 


pm=11+5(E)CX*V 


pm=6+5*(E) 






from [(E)SI] to port DX 


_; 






31+5(E)CX*2 


CX/26+5*i*(E) 








--> 








CX*2 








w^ 


F3 6F 


REP OUTS 


17+5(E)CX, 


5+12*(E)CX, 






Output(E)CX dwords 


-Ij 




DX,r/m32 


pm=11+5(E)CX*V 


pm=6+5*(E) 






from [(E)SI] to port DX 








31+5(E)CX*2 


CX/26+5*i*(E) 








I 








CX*2 








13 


F2AC 


REP LODS 


5*3,7+4(E)CX*6 








Load (E)CX bytes from 




m8 










[(E)SI] to AL 


~3 


F2AD 


REP LODS 


5*3,7+4(E)CX*6 








Load (E)CX words from 






m16 










[(E)SI] to AX 


~'''i 


F2AD 


REP LODS 


5*3,7+4(E)CX*6 








Load (E)CX dwords 






m32 










from [(E)SI] to EAX 


'^ ^1 


F3AA 


REP STOS 


5*3,7+4(E)CX*6 


5+5*(E)CX 


4+3*CX 


9+10*CX 


Fill (E)CX bytes at 


7.) 




m8 










ES:[(E)DI] with AL 




F3AB 


REP STOS 


5*3,7+4(E)CX*6 


5+5*(E)CX 


4+3*CX 


9+10*CX 


Fill (E)CX words at 


:j 




m16 










ES:[(E)DI] with AX 




F3AB 


REP STOS 


5*3,7+4(E)CX*6 


5+5*(E)CX 






Fill (E)CX dwords at 


_j 




m32 










ES:[(E)DI] with EAX 


il3 


F3A6 


REPE 


5*3,7+7(E)CX*6 


5+9*N 


5+9*N 


9+22*N 


Find nonmatching bytes 






CMPS 










in ES:[(E)DI] and [(E)SI] 


Z} 




m8,m8 












1) 


F3A7 


REPE 


5*3,7+7(E)CX*6 


5+9*N 


5+9*N 


9+22*N 


Find nonmatching 




CMPS 










words in ES:[(E)DI] and 


:~1 




m16,m16 










[(E)SI] 
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Opcode 


Instruction 




Clocks 






Description 






486 


386 


286 


86 




F3A7 


REPE 
CMPS 
m32,m32 


5*37+7(E)CX*6 


5+9*N 






Find nonmatching 
dwords in ES:[(E)DI] 
and [(E)SI] 


F3AE 


REPE 
SCAS m8 


5*3,7+5(E)CX*6 


5+8*N 


5+8*N 


9+1 5*N 


Find non-AL byte 
starting at ES:[(E)DI] 


F3AF 


EPE SCAS 
m16 


5*3,7+5(E)CX*6 


5+8*N 


5+8*N 


9+1 5*N 


Find non-AX word 
starting at ES:[(E)DI] 


F3AF 


REPE 
SCAS m32 


5*3,7+5(E)CX*6 


5+8*N 






Find non-EAX dword 
starting at ES:[(E)DI1 


F2A6 


REPNE 

CMPS 

m8,m8 


5*3,7+7(E)CX*6 


5+9*N 


5+9*N 


9+22*N 


Find matctiing bytes in 
ES:[(E)DI] and [(E)SI] 


F2A7 


REPNE 

CMPS 

m16,m16 


5*3,7+7(E)CX*6 


5+9*N 


5+9*N 


9+22*N 


Find matching words in 
ES:[(E)DI] and [(E)SI] 


F2A7 


REPNE 

CMPS 

m32,m32 


5*3,7+7(E)CX*6 


5+9*N 






Find matching dwords 
in ES:[(E)DI1 and [(E)SI] 


F2AE 


REPNE 
SCAS m8 


5*3,7+5(E)CX*6 


5+8*N 


5+8*N 


9+1 5*N 


Find AL 


F2AF 


REPNE 
SCASm16 


5*3,7+5(E)CX*6 


5+8*N 


5+8*N 


9+1 5*N 


Find AX 


F2AF 


REPNE 
SCAS m32 


5*37+5(E)CX*6 


5+8*N 






Find EAX 


*1 IfCPL 


<IOPL 












•2 If GPL 


>IOPL 












•3lf(E)CX = 












*4lf(E)CX = 1 












*5 If (E) CX 1 












•6 If (E) CX 













REP, REPE (repeat while equal), and REPNE (repeat while not equal) are 
prefixes that are applied to string operations. Each prefix causes the string 
instruction that follows to be repeated the number of times indicated in 
the count register or (for REPE and REPNE) until the indicated condition 
in the zero flag is no longer met. 

Synonymous forms of REPE and REPNE are REPZ and REPNZ, respec- 
tively. 

The REP prefixes apply only to one string instruction at a time. To repeat 
a block of instructions, use the LOOP instruction or another looping con- 
struct. 

The precise action for each iteration is as follows: 

1. If the address-size attribute is 16 bits, use CX for the count register; if 
the address-size attribute is 32 bits, use ECX for the count register. 

2. Check CX. If it is zero, exit the iteration, and move to the next instruc- 
tion. 

3. Acknowledge any pending interrupts. 
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4. Perform the string operation once. 

5. Decrement CX or ECX by one; no flags are modified. 

6. Check the zero flag if the string operation is SCAS or CMPS. If the re- 
peat condition does not hold, exit the iteration and move to the next in- 
struction. Exit the iteration if the prefix is REPE and ZF is (the last com- 
parison was not equal), or if the prefix is REPNE and ZF is one (the last 
comparison was equal). 

7. Return to step 1 for the next iteration. 

Repeated CMPS and SCAS instructions can be exited if the count is ex- 
hausted or if the zero flag fails the repeat condition. These two cases can 
be distinguished by using either the JCXZ instruction, or by using the con- 
ditional jumps that test the zero flag (JZ, JNZ, and JNE). 



RET 



Return from procedure 



u 



Opcode Instruction 



Clocks 



Description 







486 


386 


286 


86 




C3 
CB 

CB 
C2iw 


RET 
RET 

RET 
RETimm16 


5 
13,pm=18 

13,pm=33 
5 


10+m 

18+m,pm= 

32+m 

pm=68 

10+m 


11 
15,pm=25 

55 
11 


16 
26 

20 


Retum (near) to caller 
Return (far) to caller, same 
privilege 
Return (far) 
Return (near) 


CAIw 


RETimm16 


14,pm=17 


18+m,pm= 
32+m 


15,pm=25 


25 


Return (far) pop imm16 bytes 


CAIw 


RETimm16 


14,pm=33 


pm=68 


55 




Return (far) 



_J 



RET transfers control to a return address located on the stack. The ad- 
dress is usually placed on the stack by a CALL instruction, and the return 
is made to the instruction that follows the CALL. 

The optional numeric parameter to RET gives the number of stack bytes 
(OperandMode = 16) or words (OperandMode = 32) to be released after 
the return address is popped. These items are typically used as input pa- 
rameters to the procedure called. 

For the intrasegment (near) return, the address on the stack is a segment 
offset, which is popped into the instruction pointer. The CS register is un- 
changed. For the intersegment (far) return, the address on the stack is a 
long pointer. The offset is popped first, followed by the selector. 

In real mode, CS and IP are loaded directly. In protected mode, an inter- 
segment return causes the processor to check the descriptor addressed by 
the return selector. The AR byte of the descriptor must indicate a code seg- 
ment of equal or lesser privilege (or greater or equal numeric value) than 
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the current privilege level. Returns to a lesser privilege level cause the 
stack to be reloaded from the value saved beyond the parameter block. 

The DS, ES, FS, and GS segment registers can be set to by the RET 
instruction during an interlevel transfer. If these registers refer to seg- 
ments that cannot be used by the new privilege level, they are set to to 
prevent unauthorized access from the new privilege level. 



SAHF Store AH into Flogs 



Opcode 


Instruction 




Clocks 




Description 


9E 


SAHF 


486 
2 


386 286 
3 2 


86 
4 


Store AH flags SF ZF xx AF xx PF xx CF 



SAHF loads the flags listed above with values from the AH register, from 
bits 7, 6, 4, 2 and 0, respectively. 



SAL 
SAR 


Shift instructions 


















SHL 




* 


D 


I 


T 


S Z A 
* * ? 


P c 
* * 


SHR 














Opcode 


Instruction 




Cl0Cl<E 






Description 






486 


386 


286 


86 




00/4 


SAL r/m8,1 


3/4 


3/7 


2/7 


2/15+EA 


Multiply r/m byte by 2 


D2/4 


SAL r/m8,CL 


3/4 


3/7 


5/8 


8+4 per bit/(20+4 
per bit)+EA 


Multiply r/m byte by 2, CL times 


CO /4 ib 


SAL r/m8,imm8 


2/4 


3/7 


5/8 




Multiply r/m byte by 2 


D1/4 


SALr/m16,1 


3/4 


3/7 


2/7 


2/15+EA 


Multiply r/m word by 2 


D3/4 


SALr/m16,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 
per bit)+EA 


Multiply r/m word by 2, CL times 


C1 /4 ib 


SALr/m16,imm8 


2/4 


3/7 


5/8 




Multiply r/m word by 2 


D1/4 


SAL r/m32,1 


3/4 


3/7 






Multiply r/m dword by 2 


D3/4 


SAL r/m32,CL 


3/4 


3/7 






Multiply r/m dword by 2 


C1 /4 ib 


SAL r/m32,imm8 


2/4 


3/7 






Multiply r/m dword by 2 


DO/7 


SAR r/m8,1 


3/4 


3/7 


2/7 


2/15+EA 


Signed divide" r/m byte by 2 


D2/7 


SAR r/m8,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 
per bit)+EA 


Signed divide" r/m byte by 2 


CO n ib 


SAR r/m8,imm8 


2/4 


3/7 


5/8 




Signed divide" r/m byte by 2 


D1/7 


SAR r/m16,1 


3/4 


3/7 


2/7 


2/15+EA 


Signed divide" r/m word by 2 


D3/7 


SARr/m16,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 
per bit)+EA 


Signed divide" r/m word by 2 


CI n ib 


SAR r/m16,imm8 


2/4 


3/7 


5/8 




Signed divide" r/m word by 2 


D1/7 


SAR r/m32,1 


3/4 


3/7 






Signed divide" r/m dword by 2 


D3/7 


SAR r/m32,CL 


3/4 


3/7 






Signed divide" r/m dword by 2, 
CL times 


C1/7 


SAR r/m32,imm8 


2/4 


3/7 






Signed divide" r/m dword by 2 


DO/4 


SHL r/m8,1 


3/4 


3/7 


2/7 


2/15+EA 


Multiply r/m byte by 2 
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Opcode instruction 



Clocks 



Description 



J 






486 


386 


286 


86 


J 


D2/4 


SHL r/m8,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 












per bit)+EA 


\ 


CO /4 ib 


SHL r/m8,imm8 


2/4 


3/7 


5/8 






D1/4 


SHLr/m16,1 


3/4 


3/7 


2/7 


2/15+EA 


J 

\ 


D3/4 


SHLr/m16,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 
per t)it)+EA 




C1 /4 ib 


SHLr/m16,imm8 


2/4 


3/7 


5/8 




,,) 


D1/4 


SHL r/m32,1 


3/4 


3/7 








D3/4 


SHL r/m32,CL 


3/4 


3/7 






.) 


CI/4 


SHL r/m32,imm8 


2/4 


3/7 






J 


DO/5 


SHR r/m8,1 


3/4 


3/7 


2/7 


2/15+EA 




D2/5 


SHR r/m8,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 


.} 












per bit)+EA 




CO /5 ib 


SHR r/m8,imm8 


2/4 


3/7 


5/8 




-.J 


D1/5 


SHRr/m16,1 


3/4 


3/7 


2/7 


2/15+EA 


-' 


D3/5 


SHR r/m16,CL 


3/4 


3/7 


5/8 


8+4 per bit (20+4 
per bit)+EA 


1 


CI /5 ib 


SHRr/m16,imm8 


2/4 


3/7 


5/8 




J 


D1/5 


SHR r/m32,1 


3/4 


3/7 






D3/5 


SHR r/m32,CL 


3/4 


3/7 








C1 /5 ib 


SHR r/m32,imm8 


2/4 


3/7 







Multiply r/m byte by 2, CL times 

Multiply r/m byte by 2 
Multiply r/m word by 2 
Multiply r/m word by 2, CL times 

Multiply r/m word by 2 
Multiply r/m dword by 2 
Multiply r/m dword by 2 
Multiply r/m dword by 2 
Unsigned divide r/m byte by 2 
Unsigned divide r/m byte by 2 

Unsigned divide r/m byte by 2 
Unsigned divide r/m word by 2 
Unsigned divide r/m word by 2 

Unsigned divide r/m word by 2 
Unsigned divide r/m dword by 2 
Unsigned divide r/m dword by 2 
Unsigned divide r/m dword by 2 



*Not the same division as IDIV; rounding is toward negative infinity. 
"Add 1 clock to the times shown for each shift performed. 



SAL (or its synonym, SHL) shifts the bits of the operand upward. The 
high-order bit is shifted into the carry flag, and the low-order bit is set to 
0. 

SAR and SHR shift the bits of the operand downward. The low-order bit 
is shifted into the carry flag. The effect is to divide the operand by 2. SAR 
performs a signed divide with rounding toward negative infinity (not the 
same as IDIV); the high-order bit remains the same. SHR performs an un- 
signed divide; the high-order bit is set to 0. 

The shift is repeated the number of times indicated by the second oper- 
and, which is either an immediate number or the contents of the CL regis- 
ter. To reduce the maximum execution time, the 80286/386 does not allow 
shift counts greater than 3L If a shift count greater than 31 is attempted, 
only the bottom five bits of the shift count are used. (The 8086 uses all 
eight bits of the shift count.) 

The overflow flag is set only if the single-shift forms of the instructions 
are used. For left shifts, OF is set to if the high bit of the answer is the 
same as the result of the carry flag (that is, the top two bits of the original 
operand were the same); OF is set to 1 if they are different. For SAR, OF is 
set to for all single shifts. For SHR, OF is set to the high-order bit of the 
original operand. 
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SBB 



Integer subtraction with borrow 



Opcode Instruction 



Clocks 



Description 







486 


386 


286 


86 




1Cib 


SBB AL,imm8 


1 


2 


3 


4 


Subtract with borrow immediate byte 
from AL 


1Diw 


SBBAX,imm16 


1 


2 


3 


4 


Subtract with borrow immediate word 
from AX 


1Did 


SBB EAX,imm32 


1 


2 






Subtract with borrow immediate dword 
from EAX 


80 13 ib 


SBB r/m8,imm8 


1/3 


2/7 


3/7 


4/17+EA 


Subtract with borrow immediate byte 
from r/m byte 


81 /3 iw 


SBBr/m16,imm16 


1/3 


2/7 


3/7 


4/17+EA 


Subtract with borrow immediate word 
from r/m word 


81 /3 id 


SBB r/m32,imm32 


1/3 


2/7 






Subtract with borrow immediate dword 
from r/m dword 


83 /3 ib 


SBBr/m16,imm8 


1/3 


2/7 


3/7 


4/17+EA 


Subtract with borrow sign-extended 
immediate byte from r/m word 


83 /3 ib 


SBB r/m32,imm8 


1/3 


2/7 






Subtract with borrow sign-extended 
immediate byte from r/m dword 


18 /r 


SBB r/m8,r8 


1/3 


2/6 


2/7 


3/16+EA 


Subtract with borrow byte register from 
r/m byte 


19 /r 


SBB r/m16,r16 


1/3 


2/6 


2/7 


3/16+EA 


Subtract with borrow word register 
from r/m word 


19 /r 


SBB r/m32,r32 


1/3 


2/6 






Subtract with borrow dword register 
from r/m dword 


1A/r 


SBB r8,r/m8 


1/2 


2/7 


2/7 


3/9+EA 


Subtract with borrow byte register from 
r/m byte 


IB/r 


SBBr16,r/m16 


1/2 


2/7 


2/7 


3/9+EA 


Subtract with borrow word register 
from r/m word 


IB/r 


SBB r32,r/m32 


1/2 


2/7 






Subtract with borrow dword register 
from r/m dword 



SBB adds the second operand (DEST) to the carry flag (CF) and subtracts 
the result from the first operand (SRC). The result of the subtraction is as- 
signed to the first operand (DEST), and the flags are set accordingly. 

When an immediate byte value is subtracted from a word operand, the 
immediate value is first sign-extended. 



SCAS 
SCASB 
SCASW 
SCASD 



Compare string data 
SCASD 386 and i486 only 



Opcode Instruction 



Clocks 



Description 



AE 



SCAS m8 



486 386 286 86 
6 7 7 15 



Compare bytes AL - ES:[I 
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^ 



Opcode 


Instruction 




Clocks 










486 


386 


286 


86 


AF 


SCASm16 


6 


7 


7 


15 


AF 


SCAS m32 


6 


7 






AE 


SCASB 


6 


7 


7 


15 


AF 


SCASW 


6 


7 


7 


15 


AF 


SCASD 


6 


7 







Description 

Compare words AX - ES: [Dl 
Compare dwords EAX - ES: | 
Compare bytes AL - ES:[DI] 
Compare words AX - ES: [Dl 
Compare dwords EAX - ES: | 



SCAS subtracts the memory byte or word at the destination register from 
the AL, AX or EAX register. The result is discarded; only the flags are set. 
The operand must be addressable from the ES segment; no segment over- 
ride is possible. 

If the address-size attribute for this instruction is 16 bits, DI is used as the 
destination register; otherwise, the address-size attribute is 32 bits and 
EDI is used. 

The address of the memory data being compared is determined solely by 
the contents of the destination register, not by the operand to SCAS. The 
operand validates ES segment addressability and determines the data 
type. Load the correct index value into DI or EDI before executing SCAS. 

After the comparison is made, the destination register is automatically up- 
dated. If the direction flag is (CLD was executed), the destination regis- 
ter is incremented; if the direction flag is 1 (STD was executed), it is 
decremented. The increments or decrements are by 1 if bytes are com- 
pared, by 2 if words are compared, or by 4 if doublewords are compared. 

SCASB, SCASW, and SCASD are synonyms for the byte, word and 
doubleword SCAS instructions that don't require operands. They are sim- 
pler to code, but provide no type or segment checking. 

SCAS can be preceded by the REPE or REPNE prefix for a block search of 
CX or ECX bytes or words. Refer to the REP instruction for further details. 



SETcc 



Byte set on condition 
386 and i486 only 



Opcode Instruction 



Clocks Description 



486 386 

OF 97 SETAr/m8 4/3 4/5 Set byte if above (CF=0 and ZF=0) 

OF 93 SETAE r/m8 4/3 4/5 Set byte if above or equal (CF=0) 

OF 92 SETBr/m8 4/3 4/5 Set byte if below (CF=1 ) 

OF 96 SETBEr/m8 4/3 4/5 Set byte if below or equal (CF=1 or ZF=1) 

OF 92 SETCr/m8 4/3 4/5 Set if carry (CF=1) 

OF 94 SETEr/m8 4/3 4/5 Set byte if equal (ZF=1 ) 

0F9F SETGr/m8 4/3 4/5 Set byte if greater (ZF=0 or SF=OF) 

0F9D SETGEr/m8 4/3 4/5 Set byte if greater or equal (SF=OF) 
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Opcode Instruction 



Clocks Description 







486 


386 






0F9C 


SETL r/m8 


4/3 


4/5 


Set byte 


f less (SFOF) 


0F9E 


SETLE r/m8 


4/3 


4/5 


Set byte 


f less or equal (ZF=1 and SFoOF) 


OF 96 


SETNA r/m8 


4/3 


4/5 


Set byte 


f not above (CF=1) 


OF 92 


SETNAE r/m8 


4/3 


4/5 


Set byte 


f not above or equal (CF=1) 


OF 93 


SETNB r/m8 


4/3 


4/5 


Set byte 


f not below (CF=0) 


OF 97 


SETNBE r/m8 


4/3 


4/5 


Set byte 


f not below or equal (CF=0 and ZF=0) 


OF 93 


SETNC r/m8 


4/3 


4/5 


Set byte 


f not carry (CF=0) 


OF 95 


SEINE r/mS 


4/3 


4/5 


Set byte 


f not equal (ZF=0) 


0F9E 


SETNG r/m8 


4/3 


4/5 


Set byte 


f not greater (ZF=1 or SFoOF) 


0F9C 


SETNGE r/m8 


4/3 


4/5 


Set byte 


f not greater or equal (SFoOF) 


0F9D 


SETNL r/m8 


4/3 


4/5 


Set byte 


f not less (SF=OF) 


0F9F 


SETNLE r/mS 


4/3 


4/5 


Set byte 


f not less or equal (ZF=1 and SFoOF) 


OF 91 


SETNO r/m8 


4/3 


4/5 


Set byte 


f not overflow (OF=0) 


0F9B 


SETNP r/mS 


4/3 


4/5 


Set byte 


f not parity (PF=0) 


OF 99 


SETNS r/m8 


4/3 


4/5 


Set byte 


f not sign (SF=0) 


OF 95 


SETNZ r/m8 


4/3 


4/5 


Set byte 


f not zero (ZF=0) 


OF 90 


SETO r/m8 


4/3 


4/5 


Set byte i 


f overflow (0F=1) 


0F9A 


SETP r/m8 


4/3 


4/5 


Set byte 


f parity (PF=1) 


0F9A 


SETPE r/m8 


4/3 


4/5 


Set byte 


f parity even (PF=1) 


0F9B 


SETPO r/m8 


4/3 


4/5 


Set byte 


f parity odd (PF=0) 


OF 98 


SETS r/m8 


4/3 


4/5 


Set byte 


fsign(SF=1) 


OF 94 


SETZ r/m8 


4/3 


4/5 


Set byte 


fzero(ZF=1) 



SETcc stores a byte containing 1 at the destination specified by the effec- 
tive address or register if the condition is met, or a byte if the condition 
is not met. 



SGDT 
SIDT 



Store global/interrupt descriptor table 
80286/386/486 protected mode only 



Opcode Instruction 



Clocks 



Description 







486 


386 


286 




OF 01 /O 


SGDTm 


10 


9 


11 


Store GDTR to m 


OF 01 /I 


SIDTm 


10 


9 


12 


Store IDTR to m 



SGDT/SIDT copies the contents of the descriptor table register to the six 
bytes of memory indicated by the operand. The LIMIT field of the register 
is assigned to the first word at the effective address. If the operand-size at- 
tribute is 32 bits, the next three bytes are assigned the BASE field of the 
register, and the fourth byte is written with zero. The last byte is unde- 
fined. Otherwise, if the operand-size attribute is 16 bits, the next four 
bytes are assigned the 32-bit BASE field of the register. 

SGDT and SIDT are used only in operating system software; they are not 
used in application programs. 
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J 



ZJ 



SHLD Double precision shift left 

386 and i486 only 



Opcode Instruction Clocks Description 







486 


386 


0FA4 


SHLDr/m16,r16,imm8 


2/3 


3/7 


0FA4 


SHLD r/m32,r32,imm8 


2/3 


3/7 


0FA5 


SHLDr/m16,r16,CL 


2/3 


3/7 


0FA5 


SHLD r/m32,r32,CL 


2/3 


3/7 



r/m16 gets SHL of r/m16 concatenated with r16 
r/m32 gets SHL of r/m32 concatenated witfi r32 
r/m16 gets SHL of r/m16 concatenated witfi r16 
r/m32 gets SHL of r/m32 concatenated witfi r32 



SHLD shifts the first operand provided by the r/m field to the left as 
many bits as specified by the count operand. The second operand (rl6 or 
r32) provides the bits to shift in from the right (starting with bit 0). The re- 
sult is stored back into the r/m operand. The register remains unaltered. 

The count operand is provided by either an immediate byte or the con- 
tents of the CL register. These operands are taken MODULO 32 to pro- 
vide a number between and 31 by which to shift. Because the bits to 
shift are provided by the specified registers, the operation is useful for 
multiprecision shifts (64 bits or more). The SF, ZF and PF flags are set ac- 
cording to the value of the result. CF is set to the value of the last bit 



'_) shifted out. OF and AF are left undefined. 

Z' SHRD Double precision shift right 

1) 386 and i486 only 



Opcode Instruction Clocks Description 







486 


386 


OF AC 


SHRD r/m16,r16,imm8 


2/3 


3/7 


OF AC 


SHRD r/m32,r32,imm8 


2/3 


3/7 


OF AD 


SHRDr/m16,r16,CL 


3/4 


3/7 


OF AD 


SHRD r/m32,r32,CL 


3/4 


3/7 



r/m16 gets SHR of r/m16 concatenated with r16 
r/m32 gets SHR of r/m32 concatenated with r32 
r/m16 gets SHR of r/m16 concatenated with r16 
r/m32 gets SHR of r/m32 concatenated with r32 



SHRD shifts the first operand provided by the r/m field to the right as 
many bits as specified by the count operand. The second operand (rl6 or 
r32) provides the bits to shift in from the left (starting with bit 31). The re- 
sult is stored back into the r/m operand. The register remains unaltered. 

The count operand is provided by either an immediate byte or the con- 
tents of the CL register. These operands are taken MODULO 32 to pro- 
vide a number between and 31 by which to shift. Because the bits to 
shift are provided by the specified register, the operation is useful for 
multi-precision shifts (64 bits or more). The SF, ZF and PF flags are set ac- 
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cording to the value of the result. CF is set to the value of the last bit 
shifted out. OF and AF are left undefined. 



SLOT Store local descriptor table register 

80286/386/486 protected mode only 

ODITSZAPC 

Opcode Instruction Clocks Description 

^6 386 286 
OF 00/0 SLDTr/m16 2/3 pm=2/2 2/3 Store LDTR to EA word 

SLDT stores the Local Descriptor Table Register (LDTR) in the two-byte 
register or memory location indicated by the effective address operand. 
This register is a selector that points into the global descriptor table. 

SLDT is used only in operating system software. It is not used in applica- 
tion programs. 



SMSW Store machine status word 

80286/386/486 protected mode only 



ODITSZAPC 



Opcode Instruction Clocks Description 



486 386 286 
OF 01/4 SMSWr/m16 2/3 2/3,pm=2/2 2/3 Store machine status word to EA word 

SMSW stores the machine status word (part of CRO) in the two-byte regis- 
ter or memory location indicated by the effective address operand. 



STC Set carry flag 



s Z A p c 

1 



Opcode 


Instruction 


Clocks 




Description 


F9 


486 
STC 2 


386 286 
2 2 


86 
2 


Set carry flag 



STC sets the carry flag to 1. 
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STD 



Set direction flag 



O D I 

1 



Opcode 


instruction 


Clocks 




Description 


FD 


486 
STD 2 


386 286 
2 2 


86 
2 


Set direction flag so (E)SI or (E)DI decrement 



STD sets the direction flag to 1, causing all subsequent string operations 
to decrement the index registers, (E)SI and /or (E)DI, on which they oper- 
ate. 



STI 



Set interrupt enabie flag 



Opcode 


Instruction 


Clocks 




Description 


FB 


486 
STI 5 


386 286 
3 2 


86 
2 


Set interrupt flag 



STI sets the interrupt flag to 1. The CPU then responds to external inter- 
rupts after executing the next instruction if the next instruction allows the 
interrupt flag to remain enabled. If external interrupts are disabled and 
you code STI, RET (such as at the end of a subroutine), the RET is allowed 
to execute before external interrupts are recognized. Also, if external inter- 
rupts are disabled and you code STI, CLI, then external interrupts are not 
recognized because the CLI instruction clears the interrupt flag during its 
execution. 



STOS Store string data 

STOSB STOSD 386 and i486 only 



STOSD 





D I 


T 


S 


Z A P C 


Opcode Instruction 




Clocks 






Description 


AA STOS m8 
AB STOS m16 
AB STOS m32 
AA STOSB 
AB STOSW 
AB STOSD 


486 

5 

5 

5 

5 

5 

5 


386 

4 

4 

4 

4 

4 

4 


286 

3 

3 

3 
3 


86 
11 
11 

11 
11 


Store AL in byte ES:[(E)DI] 
Store AX in word ES:[(E)DI] 
Store EAX in dword ES:[(E)DI] 
Store AL in byte ES:[(E)DI] 
Store AX in word ES:[DI] 
Store EAX in dword ES;[(E)DI] 



STOS transfers the contents of the AL, AX, or EAX register to the memory 
byte or word given by the destination register relative to the ES segment. 
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The destination register is DI for an address-size attribute of 16 bits or 
EDI for an address-size attribute of 32 bits. 

The destination operand must be addressable from the ES register. A seg- 
ment override is not possible. 

The address of the destination is determined by the contents of the desti- 
nation register, not by the explicit operand of STOS. This operand is used 
only to validate ES segment addressability and to determine the data 
type. Load the correct index value into the destination register before exe- 
cuting STOS. 

After the transfer is made, DI is automatically updated. If the direction 
flag is (CLD was executed), DI is incremented; if the direction flag is 1 
(STD was executed), DI is decremented. DI is incremented or 
decremented by 1 if a byte is stored, by 2 if a word is stored, or by 4 if a 
doubleword is stored. 

STOSB, STOSW, and STOSD are synonyms for the byte, word, and dou- 
ble-word STOS instructions, that do not require an operand. They are sim- 
pler to use, but provide no type or segment checking. 

STOS can be preceded by the REP prefix for a block fill of CX or ECX 
bytes, words, or doublewords. Refer to the REP instruction for further de- 
tails. 



STR Store task register 

80286/386/486 protected mode only 



Opcode 


Instruction 




Clocks 




Description 


OF 00 /1 


STR r/m16 


486 
2/3 


386 
pm=23/27 


286 
2/3 


Load EA word into task register 



The contents of the task register are copied to the two-byte register or 
memory location indicated by the effective address operand. 

STR is used only in operating system software. It is not used in applica- 
tion programs. 
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SUB 



Integer Subtraction 



:; 



^j 



ij 



Opcode 


Instruction 




Cloci<s 






Description 






486 


386 


286 


86 




2Cib 


SUB AL.immS 


1 


2 


3 


4 


Subtract immediate byte from AL 


2Diw 


SUBAX,imm16 


1 


2 


3 


4 


Subtract immediate word from AX 


2D id 


SUB EAX,imm32 


1 


2 






Subtract immediate dword from EAX 


80/5ib 


SUB r/m8,imm8 


1/3 


2/7 


3/7 


4/17+EA 


Subtract immediate byte from r/m byte 


81 /5 iw 


SUBr/m16,imm16 


1/3 


2/7 


3/7 


4/17+EA 


Subtract immediate word from r/m word 


81 /5 id 


SUB r/m32,imm32 


1/3 


2/7 






Subtract immediate dword from r/m dword 


83 /5 ib 


SUBr/m16,imm8 


1/3 


2/7 


3/7 


4/17+EA 


Subtract sign-extended immediate byte 
from r/m word 


83 /5 ib 


SUB r/m32,imm8 


1/3 


2/7 






Subtract sign-extended immediate byte 
from r/m dword 


28 /r 


SUB r/m8,r8 


1/3 


2/6 


2/7 


3/16+EA 


Subtract byte register from r/m byte 


29 /r 


SUBr/m16,r16 


1/3 


2/6 


2/7 


3/16+EA 


Subtract word register from r/m word 


29 /r 


SUB r/m32,r32 


1/3 


2/6 






Subtract dword register from r/m dword 


2A/r 


SUB r8,r/m8 


1/2 


2/7 


2/7 


3/9+EA 


Subtract EA byte from byte register 


2B/r 


SUBr16,r/m32 


1/2 


2/7 


2/7 


3/9+EA 


Subtract EA word from word register 


2B/r 


SUB r32,r/m32 


1/2 


2/7 






Subtract EA dword from dword register 



SUB subtracts the second operand (SRC) from the first operand (DEST). 
The first operand is assigned the result of the subtraction, and the flags 
are set accordingly. 

When an immediate byte value is subtracted from a word operand, the 
immediate value is first sign-extended to the size of the destination oper- 
and. 



^J 



^J 



TEST 



Logical compare 



Opcode Instruction 



Clocks 



Description 



486 386 286 

A8ib TESTAL,imm8 1 2 3 

A9iw TESTAX,imm16 1 2 3 

A9id TEST EAX,imm32 1 2 

F6/0ib TEST r/m8,imm8 1/2 2/5 3/6 

F7/0iw TESTr/m16,imm16 1/2 2/5 3/6 

F7/0id TEST r/m32,imm32 1/2 2/5 

84 /r TESTr/m8,r8 1/2 2/5 2/6 

85 /r TESTr/m16,r16 1/2 2/5 2/6 

85 /r TEST r/m32,r32 1/2 2/5 



4 And immediate byte witli AL 

4 And immediate word withi AX 

And immediate dword witti EAX 
5/1 1 +EA And immediate byte with r/m byte 
5/1 1 +EA And immediate word witfi r/m word 

And immediate dword with r/m dword 
3/9+EA And byte register with r/m byte 
3/9+EA And word register with r/m word 

And dword register with r/m dword 



TEST computes the bit-wise logical AND of its two operands. Each bit of 
the result is 1 if both of the corresponding bits of the operands are 1; 
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otherwise, each bit is 0. The result of the operation is discarded and only 
the flags are modified. 



VERR Verify a segment for reading or writing 

VERW 80286/386/486 protected mode only 



Opcode Instruction Clocks Description 





486 386 286 


OF 00/4 VERRr/m16 


1 1/1 1 pm=10/1 1 14/16 Set ZF=1 if segment can be read 


OF 00/5 VERWr/m16 


11/11 pm=15/16 14/16 Set ZF=1 if segment can be written 



The two-byte register or memory operand of VERR and VERW contains 
the value of a selector. VERR and VERW determine whether the segment 
denoted by the selector is reachable from the current privilege level and 
whether the segment is readable (VERR) or writable (VERW). If the seg- 
ment is accessible, the zero flag is set to 1; if the segment is not accessible, 
the zero flag is set to 0. To set ZF, the following conditions must be met: 

■ The selector must denote a descriptor within the bounds of the table 
(GDT or LDT); the selector must be "defined." 

■ The selector must denote the descriptor of a code or data segment (not 
that of a task state segment, LDT, or a gate). 

■ For VERR, the segment must be readable. For VERW, the segment must 
be a writable data segment. 

■ If the code segment is readable and conforming, the descriptor privilege 
level (DPL) can be any value for VERR. Otherwise, the DPL must be 
greater than or equal to (have less or the same privilege as) both the cur- 
rent privilege level and the selector's RPL. 

The validation performed is the same as if the segment were loaded into 
DS, ES, FS, or GS, and the indicated access (read or write) were per- 
formed. The zero flag receives the result of the validation. The selector's 
value cannot result in a protection exception, enabling the software to an- 
ticipate possible segment access problems. 



WAIT Wait until BUSY# pin is inactive (HIGH) 



Opcode 


Instruction 




Clocks 




Description 


9B 


WAIT 


486 
1-3 


386 286 
6 3 


86 
4+5n 


Wait until BUSY pin is inactive (HIGH) 
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WAIT suspends execution of CPU instructions until the BUSY# pin is inac- 
tive (high). The BUSY# pin is driven by the 80x87 numeric processor ex- 
tension. 



WBINVD 



Write-back and Invalidate cacine 
i486 oniy 



Opcode Instruction Clock Description 



OF 09 WBINVD 



486 
5 



Write-back and invalidate entire cache 



The internal cache is flushed, and a special-function bus cycle is issued 
which indicates that the external cache should write-back its contents to 
main memory. Another special-function bus cycle follows, directing the 
external cache to flush itself. 

Note: This instruction is implementation-dependent; its function might be 
implemented differently on future Intel processors. It is the responsibility 
of the hardware to respond to the external cache write-back and flush in- 
dications. 



XADD 



ExcJ-iange and add 
i486 oniy 



Opcode Instruction 



Clock Description 



OF CO/r XADD r/m8,r8 
0FC1/r XADDr/m16,r168 
OF C1/r XADD r/m32,r32 



486 
3/4 
3/4 
3/4 



Exchange byte register and r/m byte; load sum into r/m byte. 
Exchange word register and r/m word; load sum into r/m word. 
Exchange dword register and r/m dword; load sum into r/m dword. 



The XADD instruction loads DEST into SRC, and then loads the sum of 
DEST and the original value of SRC into DEST. 

DEST is the destination operand; SRC is the source operand. 

Protected mode exceptions: #GP(0) if the result is in a nonwritable seg- 
ment; #GP(0) for an illegal memory operand effective address in the CS, 
DS, ES, FS, or GS segments; #SS(0) for an illegal address in the SS seg- 
ment; #PF (fault code) for a page fault; #NM if either EM or TS in CRO is 
set; #AC for an unaligned memory reference if the current privilege level 
is 3. 
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Real address mode exceptions: interrupt 13 if any part of the operand 
would lie outside the effective address space from to OFFFFh. 

Virtual 8086 mode exceptions: same exception as in real-address mode; 
same #PF and #AC exceptions as in protected mode. 



XCHG 



Exchange memory/register with register 



Opcode Instruction 



Clocks 



Descn'ption 



86 /r 
86 /r 
87 /r 
87 /r 
87 /r 
87 /r 
90+ r 
90+ r 
90+ r 
90+ r 



XCHG 
XCHG 
XCHG 
XCHG 
XCHG 
XCHG 
XCHG 
XCHG 
XCHG 
XCHG 



486 

r/m8,r8 3/5 

r8,r/m8 3/5 

r/m16,r16 3/5 

r16,r/m16 3/5 

r/m32,r32 3/5 

r32,r/m32 3/5 

AX,r16 3 

r16,AX 3 

EAX,r32 3 

r32,EAX 3 



386 

3/5 

3/5 

3/5 

3/5 

3/5 

3/5 

3 

3 

3 

3 



286 
3/5 
3/5 
3/5 
3/5 



86 

4/17+EA Exchange byte register with EA byte 
4/17+EA Exchange byte with EA byte register 
4/1 7+EA Exchange word register with EA word 
4/1 7+EA Exchange word register with EA word 
Exchange dword register with EA dword 
Exchange dword register with EA dword 
3 Exchange word register with AX 

3 Exchange word register with AX 

Exchange dword register with EAX 
Exchange dword register with EAX 



XCHG exchanges two operands. The operands can be in either order. If a 
memory operand is involved, BUS LOCK is asserted for the duration of 
the exchange, regardless of the presence or absence of the LOCK prefix or 
of the value of the lOPL. 



XLAT 
XLATB 



Tabie iook-up transiation 



Opcode Instruction 



Clocks 



Description 







486 


386 


286 


86 




D7 


XLATm8 


4 


5 


5 


11 


Set AL to memory byte DS:[(E)BX + unsigned AL] 


D7 


XLATB 


4 


5 


5 


11 


Set AL to memory byte DS:[(E)BX + unsigned AL] 



XLAT changes the AL register from the table index to the table entry. AL 
should be the unsigned index into a table addressed by DS:BX (for an ad- 
dress-size attribute of 16 bits) or DS:EBX (for an address-size attribute of 
32 bits). 

The operand to XLAT allows for the possibility of a segment override. 
XLAT uses the contents of BX even if they differ from the offset of the 
operand. The offset of the operand should have been moved into BX/EBX 
with a previous instruction. 

The no-operand form, XLATB, can be used if the BX/EBX table will 
always reside in the DS segment. 
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XOR 



Logical exclusive OR 





o 


D 


I 


T 













Opcode 


Instruction 




Cioci^s 








486 


386 


286 


34 ib 


XOR AL,imm8 


1 


2 


3 


35 iw 


X0RAX,imm16 


1 


2 


3 


35 id 


XOR EAX,imm32 


1 


2 




80 /6 ib 


XOR r/m8,imm8 


1/3 


2/7 


3/7 


81 /6 iw 


XORr/m16,imm16 


1/3 


2/7 


3/7 


81 /6 id 


XOR r/m32,imm32 


1/3 


2/7 





Description 



83/6ib XORr/m16,imm8 1/3 2/7 
83/6ib XOR r/m32,imm8 1/3 2/7 



30 /r 


XOR r/m,r8 


1/3 


2/6 


2/7 


31 /r 


XOR r/m16,r16 


1/3 


2/6 


2/7 


31 /r 


XOR r/m32,r32 


1/3 


2/6 




32 /r 


XOR r8,r/m8 


1/2 


2/7 


2/7 


33 /r 


XORr16,r/m16 


1/2 


2/7 


2/7 


33 /r 


XOR r32,r/m32 


1/2 


2/7 





86 

4 Exclusive-OR immediate byte to AL 

4 Exclusive-OR immediate word to AX 

Exclusive-OR immediate dword to EAX 
4/17+EA Exclusive-OR immediate byte to r/m byte 
4/1 7+EA Exclusive-OR immediate word to r/m word 

Exclusive-OR immediate dword to r/m 

dword 

XOR sign-extended immediate byte to 

r/m word 

XOR sign-extended immediate byte to 

r/m dword 
3/16+EA Exclusive-OR byte register to r/m byte 
3/16+EA Exclusive-OR word register into r/m word 

Exclusive-OR dword register to r/m dword 
3/9+EA Exclusive-OR r/m byte to byte register 
3/9+EA Exclusive-OR r/m word to word register 

Exclusive-OR to r/m dword to dword 

register 



XOR computes the exclusive OR of the two operands. Each bit of the re- 
sult is 1 if the corresponding bits of the operands are different; each bit is 
if the corresponding bits are the same. The answer replaces the first op- 
erand. 
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A 



Coprocessor instructions 



This part lists the 80x87 instructions in alphabetical order. 

There is one entry for each combination of operand types that can be 
coded with the mnemonic. The following table explains the operand iden- 
tifiers used in this section: 

Identifier Explanation 

ST Stack top; the register currently at the top of the stack. 

ST(1) A register in the stack i(0<i<7) stack elements from the 

top. ST(1) is the next-on-stack register, ST(2) is below 
ST(1), etc. 

Short-real A short real (32 bits) number in memory. 

Long-real A long real (64 bits) number in memory. 

Temp-real A temporary real (80 bits) number in memory. 

Packed-decimal A packed decimal integer (18 digits, 10 bytes) in 
memory. 

Word-integer A word binary integer (16 bits) in memory. 

Short-integer A short binary integer (32 bits) in memory. 

Long-integer A long binary integer (64 bits) in memory. 

nn-bytes A memory area nn bytes long. 



Here is a summary of the possible exceptions each instruction can cause: 

■ IS = invalid operand due to stack overflow/underflow 

■ 1 = invalid operand due to other cause 

■ D = denormal operand 

■ Z = zero-divide 

■ O = Overflow 

■ U = Underflow 

H P = Inexact result (precision) 
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F2XM1 



Operands 



Computer 2^-1 

ExceptionsiP, U,D, l,S 
F2XM1 (no operands) 

Execution clocks 



Code bytes Example 



87 287 387 486 

No operands 211-476 211-476 242(140-279) 2 



F2XM1 



FABS 



Operands 



Absolute value 



Exceptions: I 

FABS (no operands) 

Execution clocks 



Code bytes Example 



87 



287 



No operands 10-17 10-17 



387 
22 



486 



FABS 



FADD 



Add real 



Exceptions; I, D,0,U,P 

FADD //source /destination, source 



Operands 


Execution clocks 




Code bytes 


Example 


//ST,ST(i)/ 
ST(i),ST 
short real 
long real 


87 287 
70-100 70-100 

90-120+EA 90-120 
95-125+EA 95-125 


387 
23-34 

24-32 
29-37 


486 
10(8-20) 

10(8-20) 
10(8-20) 


2 

2-4 
2-4 


FADD ST,ST(4) 

FADD AIR TEMP[SI] 
FADD [BX].MEAN 




Add real and 


pop 






FADDP 





Exceptions: I, D,0,U,P 
FADDP destination, source 



Operands 




Execution clocks 




Code bytes 


Example 


ST(i),ST 


87 
75-105 


287 387 
75-105 23-34 


486 
10(8-20) 


2 


FADDP ST(2),ST 
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FBLD 



Packed decimal (BCD) load 





Exceptions: 1 










FBLD source 








Operands 


Execution clocks 




Code bytes 


Example 




87 287 387 


486 






Packed decimal 


290-310 290-310 5 


75(70-103) 


2-4 


FBLD YTD_SALES 



FBSTP 



Packed decimal (BCD) store and pop 



Operands 


Exceptions: i 
FBSTP destination 

Execution clocks 


Code bytes 


Example 


Packed decimal 


87 287 387 
520-540+EA 520-540+EA 512-534 


486 
175(172-176) 2-4 


FBSTP 
[BX].FORECAST 


FCHS 


Change sign 






Operands 


Exceptions: i 

FCHS (no operands) 

Execution clocks 


Code bytes Example 




No operands 


87 287 387 486 
10-17 10-17 24-25 6 


2 FCHS 






Clear exceptions 






FCLEX 





Operands 



Exceptions; None 
FCLEX/FNCLEX (no operands) 

Execution clocks Code bytes Example 



87 



287 



387 



486 



No operands 2-8 2-8 11 



FNCLEX 
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FCOM 



Compare real 



Exceptions: I, D 
FCOM //source 



Operands 




Execution clocks 




Code bytes 


Example 


//ST(i) 
short real 
long real 


87 

40-50 
60-70+EA 
65-75+EA 


287 387 
40-50 24 
60-70 26 
65-75 31 


486 
4 
4 
4 


2-4 
2-4 


FCOM ST(1) 

FCOM [BPJ.UPPER LIMIT 

FCOM WAVELENGTH 



-.J 



^J 



FCOMP 



Compare real and pop 



Exceptioris; I, D 
FCOMP //source 



Operands 




Execution clocks 




Code bytes 


Example 


//ST(i) 
short real 
long real 


87 

42-52 
63-73+EA 
67-77+EA 


287 387 
45-52 26 
63-73 26 
67-77 31 


486 

4 

4 

4 


2 

2-4 

2-4 


FCOMP ST(2) 

FCOMP [BP+2].N READINGS 

FCOMP DENSITY 



^J 



FCOMPP 



Operands 



Compare real and pop twice 



Exceptions: I, D 
FCOMPP (no operands) 

Execution clocks Code bytes 



Example 



87 



287 



No operands 45-55 45-55 



387 486 
26 5 



FCOMPP 



3 
Z) 
Zj 



FCOS 



Cosine of ST(0) 
387 and i486 only 



Exceptions: IS, I, D, U, P 
FCOS 



Operands 




Execution clocks 




Code bytes Example 


No operands 


87 


287 387 

123-772* 


486 
241(193-279) 


2 FCOS 



*These timings hold for operands in the range fxj 14. For operands not in this range, up to 76 additional clocks may 
be needed to reduce the operand. 
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FDECSTP 



Operands 



Decrement stack pointer 



Exceptions: None 
FDECSTP (no operands) 

Execution clocl^s Code bytes 



Example 



87 



287 



No operands 6-12 6-12 



387 
22 



486 



FDECSTP 



FDISI 
FNDISI 



FDIV 



Disable interrupts 
8087 oniy 



Exceptions: None 
FDISI (no operands) 



Operands 


Execution clocks: 
Typical Range 


Operand word 
transfers 


Code 
bytes 


Example 


No operands 


5 2-8 





2 


FDISI 



Divide real 



Exceptions;!, D,Z,0,U,P 

FDIV //source /destination, source 



Operands 




Execution clocks 




Code bytes 


Example 




87 


287 


387 


486 






//ST(i),ST 


193-203 


193-203 


88-91 


73 


2 


FDIV 


short real 


215-225 


215-225 


89 


73 


2-4 


FDIV DISTANCE 


long real 


220-230 


220-230 


94 


73 


2-4 


FDIV ARC[D1] 


//ST,ST(i) 








73 







FDIVP 



Operands 



Divide real and pop 



Exceptions: I, D, Z, O, U, P 
FDIVP destination, source 

Execution clocks Code bytes 



Example 



//ST(i),ST 



87 
197-207 



287 
198-209 



387 
88-91 



486 
73 



FDIVP ST(4),ST 
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u 



FDIVR 



Operands 



Divide real reversed 



Exceptions: I, D,Z,0,U,P 

FDIVR //source/destination, source 



Execution clocl<s 



Code bytes Example 



87 



287 387 486 

198-208 88-91 73 



//ST,ST(i)/ 194-204 

ST(i),ST 73 

short real 216-226+EA 215-225 89 73 

long real 221-231+EA 220-230 94 73 



2-4 
2-4 



FDIVR ST(2),ST 

FDIVR [BX].PULSE_RATE 
FDIVR RECORDER.FREQUENCY 






FDIVRP 



Divide real reversed and pop 



Exceptions: I, D,Z,0,U,P 
FDIVRP destination, source 



Operands 




Execution clocl(s 




Code bytes 


Example 


ST(i),ST 


87 
198-208 


287 387 
198-208 88-91 


486 
73 


2 


FDIVRP ST(1),ST 



Z) 

zj 

Zj 
Z.) 

ZZ) 
D 



FENI 
FNENI 



Operands 



Enable interrupts 
8087 only 



Exceptions: None 
FENI (no operands) 

Execution clock Code bytes Example 



87 
(no operands) 5(2-8) 



FNENI 



Zj 

Zj 
Z) 



FFREE 



Operands 



ST(i) 



Free register 



Exceptions: None 
FFREE destination 

Execution clocks 



Code bytes Example 



87 
9-16 



287 
9-16 



387 
18 



486 
3 



FFREE ST(1) 
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C" 



FIADD Integer add 

Exceptions: I, D, O, P 
FIADD source 

Operands Execution ciocl<s 



Code Example 
bytes 



87 


287 


387 


486 




word integer 102-137+EA 


102-137 


71-85 


22.5(19-32) 2-4 


FIADD DISTANCE TRAVELLED 


sliort integer 108-143+EA 


108-143 


57-72 


24(20-35) 2-4 


FIADD PULSE_COUNT [Si] 



FICOM 



Operands 



Integer compare 



Exceptions: I, D 
FICOM source 

Execution clocks 



Code bytes Example 





87 


287 


387 


486 






word integer 


72-86+EA 


72-86 


71-75 


18(16-20) 


2-4 


FICOM TOOLN PASSES 


short integer 


78-91 +EA 


78-91 


56-63 


16.5(15-17) 


2-4 


FICOM [BP+4].PARM_C0UNT 



FICOMP 



Operands 



Integer compare and pop 



Exceptions: I, D 
FICOMP source 

Execution clocks 



Code bytes Example 





87 


287 


387 


486 




word integer 


74-88+EA 


74-88 


71-75 


18(16-20) 2-4 


FICOMP [BP].LIMIT [SI] 


short integer 


80-93+EA 


80-93 


56-63 


16.5(15-17) 2-4 


FICOMP N_SAMPLES 



FIDIV 



Operands 



Integer divide 



Exceptions: I, D,Z,0,U,P 
FIDIV source 

Execution clocks 



Code Example 
bytes 





87 


287 


387 486 






word integer 


224-238+EA 


224-238 


136-140 73 


2-4 


FIDIV SURVEY.OBSERVATiONS 


short integer 


230-243+EA 


230-243 


120-127 73 


2-4 


FIDIV RELATIVE_ANGLE [Dl] 
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FIDIVR 



Operands 



Integer divide reversed 



Exceptions; I, D,Z,0,U,P 
FIDIVR source 

Execution clocl<s 



Code bytes Example 





87 


287 


387 


486 






word integer 


225-239+EA 


224-238 


135-141 


73 


2-4 


FIDIVR [BP].X COORD 


siiort integer 


231-245+EA 


230-243 


121-128 


73 


2-4 


FIDIVR FREQUENCY 



FILD 



Integer load 



Exceptions: I 
FILD source 



Operands 




Execution clocl<s 


Code bytes 


Example 




87 


287 387 486 






word integer 


46-54+EA 


46-54 61-65 11.5(9-12) 


2-4 


FILD [BX].SEQUENCE 


short integer 


52-60+EA 


52-60 45-52 14.5(13-16) 


2-4 


FILD STANDOFF [Dl] 


long integer 


60-68+EA 


60-68 56-67 16.8(10-18) 


2-4 


FILD RESPONSE.COUNT 



FIMUL 



Operands 



Integer multiply 



Exceptions: I, D, O, P 
FIMUL source 

Execution clocks 



Code bytes Example 





87 287 


387 


486 






word integer 


124-138-t-EA 124-138 


76-87 


8 


2-4 


FIMUL BEARING 


short integer 


130-144+EA 130-144 


61-82 


8 


2-4 


FIMUL POSITION.Z_AXIS 



.J 
D 



FINCSTP 



Operands 



Increment stack pointer 
Exceptions: None 
FINCSTP (no operands) 

Execution clocks Code bytes 



Example 



87 



287 



387 



486 



No operands 6-12 6-12 21 



FINCSTP 



Z) 
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FINIT 
FNINIT 



Operands 



Initialize processor 



Exceptions: None 
FINIT/FNINIT (no operands) 

Execution c!ocl<s Code bytes 



Example 



No operands 


2-8 


287 387 486 

2-8 33 17 2 




FINIT 


FIST 




Integer store 






Operands 


Exceptions: 1, P 
FIST destination 

Execution clocl<s 


Code 
bytes 


Example 


word integer 
short integer 


87 287 387 486 
80-90+EA 80-90 82-95 33.4(29-34) 
82-92+EA 82-92 79-93 32.4(28-34) 


2-4 
2-4 


FIST OBS.COUNT [SI] 

FIST [BP;].FACTORED_PULSES 



FISTP 



Operands 



Integer store and pop 



Exceptions: I, P 
FISTP destination 

Execution clocks 



Code bytes Example 



87 287 387 486 

word integer 82-92+EA 82-92 82-95 33.4(29-34) 2-4 

short integer 84-94+EA 84-94 79-93 33.4(29-34) 2-4 

long integer 94-105+EA 94-105 80-97 33.4(29-34) 2-4 



FISTP [BX]. 
ALPHA_COUNT [SI] 
FISTP CORRECTED_TIME 
FISTP PANEL. N READINGS 



FISUB 



Operands 



Integer subtract 



Exceptions: I, D, O, P 
FISUB source 

Execution clocks 



Code 

bytes Example 





87 


287 


387 


486 




word integer 


102-137+EA 


102-137 


71-83 


22.5(19-32) 2-4 


FISUB BASE FREQUENCY 


short integer 


108-143+EA 


108-143 


57-82 


24(20-35) 2-4 


FISUB TRAiN_SIZE[DI] 
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Z'j 
Z'j 



FISUBR 



Operands 



Integer subtract reversed 



Exceptions: I, D, O, P 
FISUBR source 

Execution clocks 



Code bytes Example 





87 


287 


387 


486 






word integer 


103-139+EA 


102-137 


72-84 


22.5(19-32) 


2-4 


FISUBR FLOOR [BX][SI] 


short integer 


109-144+EA 


108-143 


58-83 


24(20-35) 


2-4 


FISUBR BALANCE 



J 


FLD 

Operands 




Load real 






\ 
J 


Exceptions: 1, D 
FLD source 

Execution clocks 


Code bytes 


Example 


J 


ST(i) 
short real 
long real 
Temp real 


87 

17-22 

38-56+EA 

40-60+EA 

53-65+EA 


287 387 486 

17-22 14 4 

, 38-56 20 3 

, 40-60 25 3 

, 53-65 44 6 


2 

2-4 
2-4 
2-4 


FLD ST(0) 

FLD READING [SIJ.PRESSURE 
FLD [BP].TEMPERATURE 
FLD SAVEREADING 


J 






Load control word 






FLDCW 




J 
J 


Exceptions: None 
FLDCW source 







Operands 




Execution clocks 




Code bytes 


Example 


2 bytes 


87 
7-14+EA 


287 387 
7-14 19 


486 
4 


2-4 


FLDCW CONTROL_WORD 



'13 
~j 
ZJ 
Z) 



FLDENV 



Operands 



Load environment 



Exceptions: None 
FLDENV source 

Execution clocks 



Code bytes Example 





87 


287 


387 


486 




14 bytes 


35-45+EA 


35-45 


71 


44 real or virtual 2-4 
34 protected 


FLDENV [BP+6] 



PART 5, Coprocessor instructions 



135 



FLDLG2 




Load logio2 






Operands 


Exceptions: 1 

FLDLG2 (no operands) 

Execution clocks 


Code bytes 


Example 


No operands 


8Z 
18-24 


287 387 486 
18-24 41 8 


2 


FLDLG2 






Load loge2 






FLDLN2 





Operands 



Exceptions; 1 

FLDLN2 (no operands) 

Execution clocl^s Code bytes Example 



No operands 


8Z 
17-23 


287 387 
17-23 41 


486 

8 2 


FLDLN2 






Load log2e 






FLDL2E 




Operands 


Exceptions: 1 

FLDL2E (no operands) 

Execution clocks Code bytes 


Example 


No operands 


87 
15-21 


287 387 
15-21 40 


486 

8 2 


FLDL2E 






Load Iog2l0 






FLDL2T 




Operands 


Exceptions: 1 

FLDL2T (no operands) 

Execution clocks Code bytes 


Example 


No operands 


87 
16-22 


287 387 
16-22 40 


486 

8 2 


FLDL2T 
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FLDPI 



Load P (pi) 



Operands 



Exceptions: I 

FLDPI (no operands) 

Execution clocl<s Code bytes 



Example 



87 



287 



No operands 16-22 16-22 



387 
40 



486 



FLDPI 



^ ) 



FLDZ 



Operands 



No operands 



Load +0.0 



Exceptions: I 

FLDZ (no operands) 

Execution clocks 



Code bytes Example 



87 
11-17 



287 
11-17 



387 
20 



486 
4 



FLDZ 



FLDl 



Operands 



No operands 



Load +1.0 



Exceptions: I 

FLDl (no operands) 

Execution clocks 



Code bytes Example 



87 
15-21 



287 
15-21 



387 
24 



486 
4 



FLDl 



FMUL 



Operands 



Multiply real 



Exceptions: I, D, O, U, P 

FMUL / /source/destination,source 



87 
Z^, //ST(i), ST/ST, 90-105,ST(1)* 90-105 

//ST(i),ST/ST,ST,ST(1) 130-145 

-J siiortreal 110-125+EA 

'jj long real* 112-126+EA 

long real 154-168+EA 



Execution clocks 




Code 
bytes 


Example 


287 

90-145 

90-145 

110-125 

112-168 

112-168 


387 

29-57 

29-57 

27-35 

32-57 

32-57 


486 
16 
16 
11 

14 


2 
2 

2-4 
2-4 
2-4 


FMULST,ST(3) 
FMUL ST,ST(3) 
FMUL SPEED FACTOR 
FMUL [BPj.HEIGHT 
FMUL [BPJ.HEIGHT 



'Occurs when one or both operands is "short"-it has 40 trailing zeros in its fraction (for example, it was loaded from 
a short-real memory operand). 
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FMULP 



Operands 



Multiply real and pop 



Exceptions; I, D,0,U,P 
FMULP destination,source 



Execution clocks 



Code bytes Example 





•87 


287 


387 


486 






ST(i),Sr 


94-108 


198-208 


29-57 




2 


FMULP ST(1),ST 


ST(i),ST 


134-148 


198-208 


29-57 


16 


2 


FMULP ST{1),ST 



"Occurs when one or both operands is "short"~it has 40 trailing zeros in its fraction (for example, it was loaded from 
a short-real memory operand). 



FNOP 



Operands 



No operation 



Exceptions; None 
FNOP (no operands) 

Execution clocks 



Code bytes Example 



No operands 



8Z 
10-16 



287 
10-16 



387 
12 



486 
3 



FNOP 



FPATAN 



Operands 



Partial arctangent 



Exceptions; U, P (operands not checked) 
FPATAN (no operands) 

Execution clocks Code bytes Example 



87 



287 



387 



486 



No operands 250-800 250-800 314-487 5(2-17) 2 



FPATAN 



FPREM 



Operands 



Partial remainder 



Exceptions; I, D, U 
FPREM (no operands) 

Execution clocks Code bytes 



Example 



87 



287 



387 



486 



No operands 15-190 15-190 74-155 2(2-8 



FPREM 
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-J 



:j 



FPREMl 



Operands 



No operands 



Partial remainder 
387 and i486 only 



Exceptions: I, D,U 
FPREM (no operands) 

Execution ciocl<s 



Code bytes Example 



87 



287 



387 
95-185 



486 
94.5(72-167) 



FPREIVI1 



FPTAN 



Operands 



Partial tangent 



Exceptions: I, P (operands not cinecked) 
FPTAN (no operands) 

Execution clocks Code bytes 



Example 



No operands 


87 287 387 486 
30-540 30-540 191-573 244(200-273) 


2 FPTAN 






Round to integer 




FRNDINT 




Operands 


Exceptions: 1, P 
FRNDINT (no operands) 

Execution clocks 


Code bytes Example 


No operands 


87 
16-50 


287 387 486 
16-50 66-80 29.1(21-30) 


2 FRNDINT 






Restore saved state 




FRSTOR 




Operands 


Exceptions: None 
FRSTOR source 

Execution clocks 


Code bytes Example 


87 287 387 486 
94 bytes 197-207+EA 205-215 308 131 realorvirtua 

120 protected 


1 2-4 FRSTOR [BP] 



_-■) 



Note: The 80287 execution clock count for this instruction is not meaningful in determining overall instruction execu- 
tion time. For typical frequency ratios of the 80286 and 80287 clocks, 80287 execution occurs in parallel with the op- 
erand transfers. The operand transfers determine the overall execution time of the Instructions. For 80286:80287 
clock frequency ratios of 4:8, 1:1, and 8:5, the overall execution clock count for this instruction is estimated at 490, 
302, and 227 80287 clocks, respectively. 
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FSAVE 
FNSAVE 



Operands 



Save state 

Exceptions; None 
FSAVE/FNSAVE destination 



Execution clocks 



Code bytes Example 



94 bytes 



87 287 387 

197-207+EA 205-215 375-376 



486 



2-4 



FSAVE [BP] 



Note: The 80287 execution clock count for this instruction is not meaningful in determining overall instruction execu- 
tion time. For typical frequency ratios of the 80286 and 80287 clocks, 80287 execution occurs in parallel with the op- 
erand transfers. The operand transfers determine the overall execution time of the instoiction. For 80286:80287 
clock frequency ratios of 4:8, 1 :1 , and 8:5, the overall execution clock count for this instruction is estimated at 376, 
233, and 174 80287 clocks, respectively. 



FSCALE 



Operands 



Scale 



Exceptions: l,0,U 
FSCALE (no operands) 

Execution clocks 



Code bytes Example 



No operands 



87 
32-38 



287 
32-38 



387 486 
67-86 31(30-32) 



FSCALE 



FSETPM 



Operands 



Set protected mode 



Exceptions; None 
FSETPM (no operands) 

Execution clock Code bytes Example 



No operands 



287 
2-8 



FSETPM 



FSIN 



Operands 



Sine of ST(0) 

387 and i486 oniy 



Exceptions: IS, I, D, U, P 
FSIN 



Execution clocks 



Code bytes Example 



No operands 



387 
122-771* 



241(193-279) 



FSIN 



"These timings hold for operands in the range /x/ lA. For operands not in this range, up to 76 additional clocks may 
be needed to reduce the operand. 
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FSINCOS 



Sine and cosine of ST(0) 
387 and i486 only 



Exceptions: IS, I, D, U, P 
FSINCOS 



Operands 


Execution clocks 


Code bytes 


Example 


No operands 


387 486 
194-809* 291(243-329) 


2 


FSINCOS 



'These timings hold for operands in the range /x/ 14. For operands not in this range, up to 76 additional clocks may 
be needed to reduce the operand. 



FSQRT 



Operands 



Square root 



Exceptions: I, D, P 
FSQRT (no operands) 

Execution clocks 



Code bytes Example 



87 



287 



387 



486 



No operands 180-186 180-186 122-129 85.5(83-87) 2 



FSQRT 



FST 



_j 



.-J 



Store real 



Exceptions: I, O, U, P 
FST destination 



Operands 




Execution clocks 


Code bytes 


Example 


ST(i) 
short real 
long real 


87 287 387 486 
15-22 15-22 11 3 
84-90+EA 84-90 44 7 
96-104+EA96-104 45 8 


2 

2-4 

2-4 


FST ST(3) 

FST CORRELATION [Dl] 

FST MEAN_READING 






Store control word 






FSTCW 
FNSTCW 

Operands 




Exceptions: None 
FSTCW destination 

Execution clocks 


Code bytes 


Example 


2 bytes 


87 287 387 486 
12-18+EA 12-18 15 


2-4 


FSTCW SAVE_CONTROL 
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FSTENV 
FNSTENV 



Operands 



Store environment 



Exceptions; None 
FSTENV destination 

Execution clocks 



Code bytes Example 



Mbytes 



87 287 

40-50+EA 40-50 



387 486 
103-104 



2-4 



FSTENV [BP] 



FSTP 



Operands 



Store real and pop 



Exceptions: i, O, U, P 
FSTP destination 

Execution cloci<s 



Code bytes Example 



87 287 

ST(i) 17-24 17-24 

short real 86-92+EA 86-92 

long real 98-106+EA 98-106 

Temp real 52-58+EA 52-58 



387 486 

12 3 2 

44 7 2-4 

45 8 2-4 
53 6 2-4 



FSTP ST(2) 

FSTP [BX]. ADJUSTED_RPM 
FSTP TOTAL_DOSAGE 
FSTP REG_SAVE [SI] 



FSTSW 
FNSTSW 



Operands 



Store status word 



Exceptions; None 
FSTSW/FNSTSW destination 

Execution clocks Code bytes 



Example 



2 bytes 



87 



287 



12-18+EA 12-18 



387 
15 



486 



2-4 



FSTSW SAVE STATUS 



FSTSW AX 
FNSTSW AX 



Store status word to AX 



Exceptions: None 
FSTSW destination 



Operands 




Execution clocks 




Code bytes 


Example 


AX 


8Z 


287 387 
10-16 13 


486 
3 


2 


FSTSW AX 
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FSUB 



Subtract real 



-J 



Exceptions: I, D, O, U, P 

FSUB / /source/destination,source 



Operands 


Execution clocks Code bytes 


Example 


//ST,ST/(i)/ 
ST(i),ST 
short real 
long real 


87 287 387 486 
70-100 70-100 26-37 7(5-17) 2 

90-120+EA 90-120 24-32 7(5-17) 2-4 
95-125+EA 95-125 28-36 7(5-17) 2-4 


FSUB ST,ST(2) 

FSUB BASE VALUE 
FSUB COORDINATE.X 




Subtract real and pop 




FSUBP 




operands 


Exceptions: 1, D, O, U, P 
FSUBP destination, source 

Execution clocl<s Code bytes 


Example 


ST(i),ST 


87 287 387 486 
75-105 75-105 26-37 7(5-17) 2 


FSUBP ST(2),ST 




Subtract real reversed 




FSUBR 





Exceptions: I, D, O, U, P 

FSUBR //source/destination, source 



^ 


Operands 




Execution clocks Code bytes Example 


1 


//ST,ST(i)/ 
ST(i),ST 
short real 
long real 


87 
70-100 

90-120+EA 
95-125+EA 


287 
70-100 

90-120 
95-125 


387 486 

26-37 7(5-17) 2 FSUBR ST,ST(1) 

25-33 7(5-17) 2-4 FSUBR VECTOR [SI] 
29-37 7(5-17) 2-4 FSUBR [BX].INDEX 


— ''■' 




Sut 


)tract r 






FSUBRP 


eal reversed and pop 


■Zj 


Exceptions: l,D,0,U,P 
FSUBRP destination, source 



Operands 




Execution clocks 


Code bytes 


Example 


ST(i),ST 


8Z 
75-105 


287 387 
75-105 26-37 


486 
7(5-17) 2 


FSUBRP ST(1),ST 
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FTST 



Test stack top against +0.0 



Operands 




Exceptions: 1, D 
FTST (no operands) 

Execution clocl<s 


Code bytes Example 


No operands 


87 
38-48 


287 387 486 
38-48 28 4 


2 FTST 




ExecL 


Unordered compc 
387 and i486 only 




FUCOM 


ire 


Operands 


Exceptions: IS, 1, D 
ition clocks Code bytes 


Example 


//ST(i) 


387 
24 


486 

4 2 


FUCOM ST(1) 




Execi 


Unordered compc 
387 and I486 only 




FUCOMP 


ire 


Operands 


Exceptions: IS, 1, D 
Jtion clocks Code bytes 


Example 


//ST(i) 


387 
26 


486 

4 2 


FUCOMP ST(2) 




P 

Execi 


Unordered compc 
387 and i486 only 




FUCOMP 


jre 


Operands 


Exceptions: IS, 1, D 
Jtion clocks Code bytes 


Example 


No operands 


387 
26 


486 

5 2 


FUCOMPP 






Wait 




FWAIT 





Exceptions: None (CPU instruction) 
FWAIT (no operands) 
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^J 



Operands Execution clocks Code bytes Example 

387 486 

No operands 3+5/7* 1-3 1 FWAIT 

*/7 = number of time CPU examines BUSY line before 80287 completes execution of previous instruction. 



FXAM Examine stack top 



Exceptions: None 
FXAM (no operands) 

Operands Execution clocks Code bytes Example 

87 287 387 486 
No operands 12-23 12-23 30-38 8 2 FXAt^^ 

FXCH Exchange registers 



Exceptions: I 

FXCH //destination 



Operands 




Execution clocks 




Code bytes 


Example 


//ST(i) 


8Z 
10-15 


287 387 
10-15 18 


486 
4 


2 


FXCH ST(2) 



FXTRACT Extract exponent and significant 



Exceptions: I 

FXTRACT (no operands) 



Operands 




Execution clocks 




Code bytes 


Example 


No operands 


8Z 
27-55 


287 387 
27-55 70-76 


486 
19(16-20) 


2 


FXTRACT 



FYL2X Y * log2X 



Exceptions: P (operands not cl-iecl<ecl) 
FYL2X (no operands) 

Operands Execution clocks Code bytes Example 

87 287 387 486 

No operands 900-1100 900-1100 120-538 311(196-329) 2 FYL2X 
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FYL2XP1 Y*log2(X+l) 

Exceptions; P (operands not checked) 
FYL2XP1 (no operands) 

Operands Execution clocks Code bytes 



Example 



87 287 387 486 

No operands 700-1000 700-1000 257-547 313(171-326) 2 FYL2XP1 



F2XM1 



Operands 



2>f-l 



Exceptions: U, P (operands not cl^ecked) 
F2XM1 (no operands) 

Execution clocks Code bytes Example 



87 



287 



387 



486 



No operands 310-630 310-630 211-476 242(140-279) 



F2XM1 
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o 
o 

3 

n 



3 
3 
3 
3 
3 
3 
3 
3 
3 
3 
3 
3 
3 
3 
D 
D 
X 
D 
3 
3 
3 
3 
3 
3 
3 
3 
3 
O 
O 
O 
O 
O 
O 
3 
O 
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